CVE-2025-53909 - CVE House
Back to Database
Status published Critical CVE-2025-53909

mailcow: dockerized vulnerable to SSTI in Quota and Quarantine Notification Template

Vulnerability Description

mailcow: dockerized is an open source groupware/email suite based on docker. A Server-Side Template Injection (SSTI) vulnerability exists in versions prior to 2025-07 in the notification template system used by mailcow for sending quota and quarantine alerts. The template rendering engine allows template expressions that may be abused to execute code in certain contexts. The issue requires admin-level access to mailcow UI to configure templates, which are automatically rendered during normal system operation. Version 2025-07 contains a patch for the issue.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2025-53909

Credits & Attribution

No credits recorded in the NVD database.

References

More from mailcow

View All →
CVE-2025-25198
mailcow: dockerized vulnerable to password reset poisoning
High 7.1
CVE-2024-41960
Cross-site Scripting (XSS) via Relay Hosts Configuration in mailcow: dockerized
Low 3.8
CVE-2024-41959
Cross-site Scripting (XSS) via API Logs in mailcow: dockerized
High 7.6
CVE-2024-41958
Two-Factor Authentication (2FA) Bypass in mailcow: dockerized
Medium 6.6
CVE-2024-31204
mailcow Cross-site Scripting Vulnerability via Exception Handler
Medium 6.1

Affected Vendor

Affected Software

mailcow-dockerized
Vulnerable Versions:
< 2025-07

Timeline

Official Publish: July 17th, 2025
Last Modified: July 17th, 2025
Added to House: July 22nd, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

Weaknesses (CWE)

CWE-1336

MITRE ATT&CK TTPs

No associated TTPs found for this vulnerability.