Mailcow: dockerized before 2026-11 contains a server-side template injection…

mailcow: dockerized

mailcow: dockerized before 2026-11 contains a server-side template injection vulnerability that allows domain administrators to execute commands in the shared rspamd container by storing a malicious domain-wide footer.

Do this now

Upgrade mailcow: dockerized to version 2026-11 or later, since earlier releases allow domain admins to run commands in the shared rspamd container.

Fix it

mailcow: dockerized

Apply >= 2026-11
On 2026.xUpgrade to mailcow: dockerized 2026-11

First seen: 10 Nov 2026
Last update: 10 Nov 2026, 17:18 UTC
Fixed in: >= 2026-11
2026-11
Identifiers: CVE-2026-125757
CVSS: 9.1
Source: news

Check this repository for exposure to one security incident from pwned.coffee. Report first, change nothing until I say so.

## Mailcow: dockerized before 2026-11 contains a server-side template injection…
Severity: critical. Patch status: patched.
Affected: mailcow: dockerized
Fixed in: >= 2026-11, 2026-11
Ids: CVE-2026-125757

mailcow: dockerized before 2026-11 contains a server-side template injection vulnerability that allows domain administrators to execute commands in the shared rspamd container by storing a malicious domain-wide footer.

## Steps
1. Search the repo, its CI and infra config for mailcow: dockerized. If present, report the version in use and whether it's affected.
2. Fix by release line: mailcow: dockerized: older than 2026-11 → >= 2026-11; 2026-11.

## Fix by release line
| Line | State | Fix | Until then |
|---|---|---|---|
| mailcow: dockerized older than 2026-11 | fixed | >= 2026-11 | — |
| mailcow: dockerized | fixed | 2026-11 | — |

## Report
A table: file, product or package, version in use, affected yes/no, exact fix. Then anything a human has to check outside the repo.

If you have the pwned.coffee MCP server (https://pwned.coffee/mcp), call lookup_cve("CVE-2026-125757") for the latest, and check_repo with this repo's lockfiles, Dockerfiles and workflows for a full receipt.
Sources: https://github.com/mailcow/mailcow-dockerized/blob/55982ac74bfd35581cc44b122ab5fc659e3ae90a/data/conf/rspamd/lua/rspamd.local.lua#L847-L850 https://nvd.nist.gov/vuln/detail/CVE-2026-125757
https://pwned.coffee/i/mailcow-dockerized-before-2026-11-contains-a-server-side-cve-2026-125757

Timeline

10 Nov 2026, 17:18 UTC
Fix status: unknown → patched.
10 Nov 2026
First reported.

Receipt

Exploitation: Public exploit code, no attacks reported
CISA ADP “CISA ADP rates exploitation of CVE-2026-125757 "poc" (SSVC).” source
Fix by release line: Product Affected Fixed in Source
mailcow: dockerized < 2026-11 >= 2026-11 GitHub advisory checked 10 Nov
mailcow: dockerized before 2026-11 2026-11 CVE record (CNA) checked 10 Nov
Score: CVSS 9.1 (critical). CVSS 3.1 9.1 (CNA VulnCheck) for CVE-2026-125757
Last checked: 13 Nov 2026, 16:26 UTC

Product	Affected	Fixed in	Source
mailcow: dockerized	< 2026-11	>= 2026-11	GitHub advisory checked 10 Nov
mailcow: dockerized	before 2026-11	2026-11	CVE record (CNA) checked 10 Nov

Sources: KEV – CVE record ✓ Vendor ✓

Sources

Follow on X

Totalone very hot coffee