PT-2025-29910 · Mailcow · Mailcow

Natalia Baranova · Published 2025-07-17 · Updated 2025-07-22 · CVE-2025-53909

Positive Technologies · (AI Summary)

CVSS v3.1

9.1

9.1

Critical

Base vector

AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions:

mailcow: dockerized versions prior to 2025-07

Description:

A Server-Side Template Injection (SSTI) vulnerability exists in the notification template system used for sending quota and quarantine alerts. The template rendering engine allows template expressions that may be abused to execute code in certain contexts. Exploitation requires admin-level access to the mailcow UI to configure templates, which are automatically rendered during normal system operation.

Recommendations:

Update to version 2025-07 or later.

Fix

Weakness Enumeration

CWE-1336

Related Identifiers

CVE-2025-53909

GHSA-8P7G-6CJJ-WR9M

Affected Products

Mailcow

References · 8

• https://osv.dev/vulnerability/CVE-2025-53909 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-53909 · Security Note
• https://github.com/mailcow/mailcow-dockerized/commit/8c5f6c03214a4b2bdbf3c78932f860eee949012b · Note
• https://github.com/mailcow/mailcow-dockerized/security/advisories/GHSA-8p7g-6cjj-wr9m · Note
• https://twitter.com/CVEnew/status/1945849860231430434 · Twitter Post
• https://twitter.com/cracbot/status/1947612638432862538 · Twitter Post
• https://t.me/cvetracker/28031 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1945863312450719903 · Twitter Post