What’s Vulnerable › Vulnerabilities
CVE-2026-40878: mailcow-dockerized Login Page has Reflected Parameter Injection / Wrong-Context XSS Escaping
- Severity: low (CVSS 2.1 v4.0)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 0.8% probability of exploitation in the next 30 days
- Public exploit or detection template: yes
- Published: 2026-04-21 · updated 2026-10-26
- Weakness: CWE-79
Description
mailcow: dockerized is an open source groupware/email suite based on docker. In versions prior to 2026-03b, the mailcow web interface passes the raw `$_SERVER['REQUEST_URI']` to Twig as a global template variable and renders it inside a JavaScript string literal in the `setLang()` helper of `base.twig`, relying on Twig's default HTML auto-escaping instead of the context-appropriate `js` escaping strategy. In addition, the `query_string()` Twig helper merges all current `$_GET` parameters into the language-switching links on the login page, so attacker-supplied parameters are reflected and preserved across navigation. Version 2026-03b fixes the vulnerability.
Affected products
- mailcow-dockerized: before 2026-03b
References
Get alerted when CVE-2026-40878 or the next vulnerability affects your stack