mailcow: dockerized vulnerabilities

mailcow: dockerized before version 2026-03b has an XSS vulnerability in the "Seen successful connections" (login history) view, where the client IP is rendered without HTML escaping. Because the server trusts the X-Real-IP header as the source IP, an attacker can inject HTML/JS. This Self-XSS can be exploited by Login CSRF to force the victim into the attacker's account.

mailcow: dockerized before version 2026-03b has an XSS vulnerability in the Quarantine details modal, where attachment filenames are inserted into HTML without escaping, allowing arbitrary HTML/JS execution. An attacker can deliver an email with a crafted attachment name so that when an admin views the quarantine item, JavaScript executes in their browser, taking over their account.

In mailcow: dockerized before 2026-03b, Autodiscover logs in the admin dashboard render the EMailAddress value without HTML escaping. An unauthenticated attacker can submit a crafted Autodiscover request with HTML/JS, which executes when an admin views the logs.

A stored cross-site scripting vulnerability was discovered in the administrator Queue Manager of mailcow-dockerized. The Queue Manager fetches mail queue entries from /api/v1/get/mailq/all, copies server-controlled Postfix queue fields into DataTables rows, and renders several of those fields as HTML without adequate output encoding.