CVE-2025-53909

Katalog CVE

CVSS 7.2 · High EPSS 0,50%

Kerentanan Improper Neutralization of Special Elements Used in a Template Engine pada mailcow. Skor CVSS 3.1 7.2 (High) menurut NVD.

Deskripsi (NVD)

mailcow: dockerized is an open source groupware/email suite based on docker. A Server-Side Template Injection (SSTI) vulnerability exists in versions prior to 2025-07 in the notification template system used by mailcow for sending quota and quarantine alerts. The template rendering engine allows template expressions that may be abused to execute code in certain contexts. The issue requires admin-level access to mailcow UI to configure templates, which are automatically rendered during normal system operation. Version 2025-07 contains a patch for the issue.

Rincian

Terbit di NVD

17 Juli 2025

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

7.2 (High), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-1336: Improper Neutralization of Special Elements Used in a Template Engine

EPSS (30 hari)

0,50% peluang dieksploitasi; lebih tinggi dari 41,1% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/mailcow/mailcow-dockerized/security/advisories/GHSA-8p7g-6cjj-wr9m advisory vendor
• https://github.com/mailcow/mailcow-dockerized/commit/8c5f6c03214a4b2bdbf3c78932f860eee949012b patch