CVE-2026-40873
High
Description
mailcow: dockerized is an open source groupware/email suite based on docker. In versions prior to 2026-03b, the Quarantine details modal injects attachment filenames into HTML without escaping, allowing arbitrary HTML/JS execution. An attacker can deliver an email with a crafted attachment name so that when an admin views the quarantine item, JavaScript executes in their browser, taking over their account. Version 2026-03b fixes the vulnerability.
SeverityHigh
CVSS8.9
Exploit probability—
ProductMailcow-dockerized
PublishedApr 21, 2026
First seenApr 21, 2026
Weakness typeCWE-79Cross-site scripting (XSS)CWE-80CWE-80
How to fix
Sources list no fixed version or patch link for this vulnerability.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| mailcow mailcow-dockerized | < 2026-03b | — |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.