PT-2025-7054 · Mailcow · Mailcow

Donncha Ó Cearbhaill · Published 2025-02-12 · Updated 2026-02-18 · CVE-2025-25198

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: mailcow: dockerized versions prior to 2025-01a

Description: A vulnerability in the password reset functionality of mailcow allows an attacker to manipulate the Host HTTP header to generate a password reset link pointing to an attacker-controlled domain. This can lead to account takeover if a user clicks the poisoned link.

Recommendations: For versions prior to 2025-01a, update to version 2025-01a to resolve the issue. As a temporary workaround, consider deactivating the password reset functionality by clearing Notification email sender and Notification email subject under System -> Configuration -> Options -> Password Settings.

Exploit

Fix

Open Redirect

Weakness Enumeration

CWE-601

Related Identifiers

BDU:2025-09073

CVE-2025-25198

GHSA-3MVX-QW4R-FCQF

Affected Products

Mailcow

References · 17

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/25xxx/CVE-2025-25198.json · Exploit
• 🔥 https://github.com/enzocipher/CVE-2025-25198-PoC · Exploit
• 🔥 https://exploit-db.com/exploits/52485 · Exploit
• https://github.com/mailcow/mailcow-dockerized/security/advisories/GHSA-3mvx-qw4r-fcqf · Vendor Advisory
• https://bdu.fstec.ru/vul/2025-09073 · Security Note
• https://osv.dev/vulnerability/CVE-2025-25198 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-25198 · Security Note
• https://t.me/pentestingnews/56621 · Telegram Post
• https://twitter.com/Iam_al_or/status/2024213933557498262 · Twitter Post
• https://twitter.com/CVEnew/status/1889761638754173332 · Twitter Post
• https://twitter.com/the_yellow_fall/status/1891302402910814553 · Twitter Post
• https://t.me/cvedetector/17906 · Telegram Post
• https://twitter.com/Iam_al_or/status/2021771270396768267 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1889785704634319096 · Twitter Post
• https://twitter.com/adriananglin/status/1891399342734385549 · Twitter Post