CVE-2026-125757 mailcow: dockerized before 2026-11 Template Injection RCE via Domain-Wide Footer
- Exploited in the wild
- Not known
- Fix
- None listed
What is CVE-2026-125757?
CVE-2026-125757 is a critical vulnerability in mailcow: dockerized, published on 10 Nov 2026.
Official description
mailcow: dockerized before 2026-11 contains a server-side template injection vulnerability that allows domain administrators to execute commands in the shared rspamd container by storing a malicious domain-wide footer. Attackers can embed a Jinja macro with an os.execute default value, rendered by the rspamd MOO_FOOTER prefilter, to read or inject mail for every tenant and disable filtering.
Weakness: CWE-1336
Which versions are affected by CVE-2026-125757?
How do I fix CVE-2026-125757?
No fix has been published for CVE-2026-125757 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-125757 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-125757 exists.
Public exploit code: 1 proofs of concept on GitHub.
Sources
Also known as GHSA-jgr3-fv33-x43c, GHSA-pg35-3wf2-cwx5.