CVE-2026-125757

Name of the Vulnerable Software and Affected Versions mailcow: dockerized versions prior to 2026-11

Description A server-side template injection exists that allows domain administrators to execute commands within the shared rspamd container. This is achieved by storing a malicious domain-wide footer containing a Jinja macro with an os.execute default value, which is then rendered by the rspamd MOO FOOTER prefilter. Successful exploitation enables the attacker to read or inject mail for every tenant and disable filtering.

Recommendations Update to version 2026-11.