Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
2.1
CVE-2026-40878: mailcow-dockerized login page may execute malicious script
CVE-2026-40878 · published 6 months ago
Summary
Versions of mailcow-dockerized before the 2026-03b release allow a crafted web address to insert malicious code into the login page. An attacker could trick a user into clicking such a link and run unwanted scripts in their browser, potentially stealing data or hijacking the session. Upgrade to version 2026-03b or later, which corrects the way URLs are handled, to eliminate the risk.
Original advisory text
mailcow-dockerized Login Page has Reflected Parameter Injection / Wrong-Context XSS Escaping
mailcow: dockerized is an open source groupware/email suite based on docker. In versions prior to 2026-03b, the mailcow web interface passes the raw `$_SERVER['REQUEST_URI']` to Twig as a global template variable and renders it inside a JavaScript string literal in the `setLang()` helper of `base.twig`, relying on Twig's default HTML auto-escaping instead of the context-appropriate `js` escaping strategy. In addition, the `query_string()` Twig helper merges all current `$_GET` parameters into the language-switching links on the login page, so attacker-supplied parameters are reflected and preserved across navigation. Version 2026-03b fixes the vulnerability.
Internet-facing
60 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit
- Gives an attacker partial control
Type
CWE-79Cross-site Scripting (XSS)
Timeline
Published21 Apr 2026
Updated31 Oct 2026
First seen21 Apr 2026
Track software like this
Free during beta