PT-2025-29910 · Mailcow · Mailcow

Natalia Baranova · Published 2025-07-17 · Updated 2025-07-22 · CVE-2025-53909

Positive Technologies · (AI Summary)

CVSS v3.1

9.1

Critical

AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions mailcow: dockerized versions prior to 2025-07

Description A Server-Side Template Injection (SSTI) vulnerability exists in the notification template system used for sending quota and quarantine alerts. The template rendering engine allows template expressions that may be abused to execute code in certain contexts. Exploitation requires admin-level access to the mailcow UI to configure templates, which are automatically rendered during normal system operation.

Recommendations Update to version 2025-07 or later.

Fix

Weakness Enumeration

CWE-1336

Related Identifiers

CVE-2025-53909

GHSA-8P7G-6CJJ-WR9M

Affected Products

Mailcow

References · 8

• https://github.com/mailcow/mailcow-dockerized/security/advisories/GHSA-8p7g-6cjj-wr9m · Vendor Advisory
• https://github.com/mailcow/mailcow-dockerized/commit/8c5f6c03214a4b2bdbf3c78932f860eee949012b · Patch
• https://osv.dev/vulnerability/CVE-2025-53909 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-53909 · Security Note
• https://t.me/cvetracker/28031 · Telegram Post
• https://twitter.com/CVEnew/status/1945849860231430434 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1945863312450719903 · Twitter Post
• https://twitter.com/cracbot/status/1947612638432862538 · Twitter Post