CVE-2022-31138 OS Command Injection in mailcow
Attackers can execute arbitrary code by manipulating specific sync job parameters in mailcow, requiring an upgrade to patch.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2022-31138?
CVE-2022-31138 is a high-severity command injection vulnerability in mailcow-dockerized, published on 11 Jul 2022. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
mailcow is a mailserver suite. Prior to mailcow-dockerized version 2022-06a, an extended privilege vulnerability can be exploited by manipulating the custom parameters regexmess, skipmess, regexflag, delete2foldersonly, delete2foldersbutnot, regextrans2, pipemess, or maxlinelengthcmd to execute arbitrary code. Users should update their mailcow instances with the `update.sh` script in the mailcow root directory to 2022-06a or newer to receive a patch for this issue. As a temporary workaround, the Syncjob ACL can be removed from all mailbox users, preventing changes to those settings.
Weakness: CWE-78
Which versions are affected by CVE-2022-31138?
It affects 1 product.
Products include Mailcow Mailcow\.
How do I fix CVE-2022-31138?
No fix has been published for CVE-2022-31138 yet. Limit exposure of the affected software until one is available.
Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.
Is CVE-2022-31138 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2022-31138 exists.
Public exploit code: 1 proofs of concept on GitHub.
Other vulnerabilities in mailcow-dockerized
- CVE-2025-53909 mailcow: dockerized vulnerable to SSTI in Quota and Quarantine Notification Template
- CVE-2024-24760 Mailcow Docker Container Exposure to Local Network
- CVE-2023-34108 Manipulation of Internal Dovecot Variables in mailcow via crafted Passwords
- CVE-2022-31245 Command injection in n/a
- CVE-2017-8928 Cross-site request forgery in n/a
Sources
Also known as GHSA-vx9w-h33p-5vhc.