CVE-2026-40878
LowCVSS 2.1Exploitation Probability (EPSS)
Elevated risk57th percentile - higher than 57% of all known CVEs
Summary
In mailcow versions prior to 2026-03b, the web interface passes the raw $_SERVER['REQUEST_URI'] to Twig as a global template variable and renders it inside a JavaScript string literal in the setLang() helper of base.twig, relying on Twig's default HTML auto-escaping instead of context-appropriate JS escaping. Additionally, the query_string() Twig helper merges all current $_GET parameters into the language-switching links on the login page, so attacker-supplied parameters are reflected and preserved across navigation. Version 2026-03b fixes the vulnerability.
Risk Assessment
An attacker can inject malicious JavaScript executed in the victim's browser (XSS), potentially leading to session or credential theft. Risk applies to mailcow instances running versions prior to 2026-03b.
Recommendation
Update mailcow to version 2026-03b or later. Until updated, consider restricting access to the web interface.
Other vulnerabilities in mailcow
See all- CVE-2017-8928High
Mailcow version 0.14, used in 'mailcow: dockerized' and other products, has a CSRF vulnerability.
- CVE-2026-40874Medium
In mailcow versions prior to 2026-03b, no administrator verification occurs when deleting Forwarding Hosts via /api/v1/delete/fwdhost. Any authenticated user can call this API, potentially significantly disrupting the mail service.
- CVE-2023-34108High
A vulnerability has been discovered in mailcow, a mail server suite, that allows an attacker to manipulate internal Dovecot variables by using specially crafted passwords during the authentication process. The issue arises from the behavior of the `passwd-verify.lua` script, which verifies user passwords during login attempts.
Original NVD description (English source)
mailcow: dockerized is an open source groupware/email suite based on docker. In versions prior to 2026-03b, the mailcow web interface passes the raw `$_SERVER['REQUEST_URI']` to Twig as a global template variable and renders it inside a JavaScript string literal in the `setLang()` helper of `base.twig`, relying on Twig's default HTML auto-escaping instead of the context-appropriate `js` escaping strategy. In addition, the `query_string()` Twig helper merges all current `$_GET` parameters into the language-switching links on the login page, so attacker-supplied parameters are reflected and preserved across navigation. Version 2026-03b fixes the vulnerability.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS