CVE-2025-53909 mailcow: dockerized vulnerable to SSTI in Quota and Quarantine Notification Template

What is CVE-2025-53909?

CVE-2025-53909 is a critical code injection vulnerability in mailcow-dockerized, published on 17 Jul 2025. An attacker needs administrator access to exploit it, with no action from the victim.

Official description

mailcow: dockerized is an open source groupware/email suite based on docker. A Server-Side Template Injection (SSTI) vulnerability exists in versions prior to 2025-07 in the notification template system used by mailcow for sending quota and quarantine alerts. The template rendering engine allows template expressions that may be abused to execute code in certain contexts. The issue requires admin-level access to mailcow UI to configure templates, which are automatically rendered during normal system operation. Version 2025-07 contains a patch for the issue.

Weakness: CWE-1336

Which versions are affected by CVE-2025-53909?

It affects 1 product.

Products include Mailcow Mailcow\.

How do I fix CVE-2025-53909?

No fix has been published for CVE-2025-53909 yet. Limit exposure of the affected software until one is available.

Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.

Is CVE-2025-53909 being exploited?

There is no known exploitation of CVE-2025-53909 in the wild and no public exploit code.

Other vulnerabilities in mailcow-dockerized

• CVE-2024-24760 Mailcow Docker Container Exposure to Local Network High 8.8
• CVE-2023-34108 Manipulation of Internal Dovecot Variables in mailcow via crafted Passwords High 8.8
• CVE-2022-31138 OS Command Injection in mailcow High 8.8
• CVE-2022-31245 Command injection in n/a High 8.8
• CVE-2017-8928 Cross-site request forgery in n/a High 8.8

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-8p7g-6cjj-wr9m.