Which versions of mailcow: dockerized are affected by CVE-2026-40873?

mailcow: dockerized versions prior to 2026-03b contain a stored cross-site scripting vulnerability in email attachment filename handling that allows unauthenticated attackers to execute arbitrary…. A patch is available.

How to fix or mitigate CVE-2026-40873?

Within 24 hours: inventory all mailcow deployments and document current versions; isolate mailcow administrative interfaces from untrusted networks if feasible. Within 7 days: implement email gateway filtering to block messages with suspicious attachment filenames (special characters, script tags, encoded payloads); configure Content Security Policy headers on the mailcow web interface to restrict inline script execution. Within 30 days: upgrade mailcow to version 2026-03b or later when released; perform security testing of the administrative interface post-upgrade.

mailcow: dockerized CVE-2026-40873

Q: What is the CVSS score of CVE-2026-40873?

CVE-2026-40873 has a CVSS 4.0 base score of 8.9 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.1%.

EUVD-2026-24255 HIGH

Cross-site Scripting (XSS) (CWE-79)

2026-04-21 GitHub_M

XSS Docker

8.9

CVSS 4.0 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

8.9 HIGH

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Scope

Lifecycle Timeline

Re-analysis Queued

Apr 22, 2026 - 21:07 vuln.today

cvss_changed

Patch released

Apr 22, 2026 - 21:02 nvd

Patch available

Apr 21, 2026 - 21:02 EUVD

Analysis Generated

Apr 21, 2026 - 20:51 vuln.today

CVSS changed

Apr 21, 2026 - 20:22 NVD

8.9 (HIGH)

EUVD ID Assigned

Apr 21, 2026 - 20:00 euvd

EUVD-2026-24255

Analysis Generated

Apr 21, 2026 - 20:00 vuln.today

CVE Published

Apr 21, 2026 - 19:15 nvd

HIGH 8.9

DescriptionGitHub Advisory

mailcow: dockerized is an open source groupware/email suite based on docker. In versions prior to 2026-03b, the Quarantine details modal injects attachment filenames into HTML without escaping, allowing arbitrary HTML/JS execution. An attacker can deliver an email with a crafted attachment name so that when an admin views the quarantine item, JavaScript executes in their browser, taking over their account. Version 2026-03b fixes the vulnerability.

AnalysisAI

Stored cross-site scripting (XSS) in mailcow: dockerized (versions prior to 2026-03b) allows remote unauthenticated attackers to execute arbitrary JavaScript in administrator sessions by delivering emails with malicious attachment filenames. When administrators view quarantined emails through the web interface, unsanitized filenames inject into HTML without escaping, triggering automatic JavaScript execution that can compromise administrator accounts. No public exploit or active exploitation confirmed at time of analysis, though CVSS 8.9 (CVSS 4.0) reflects high impact with low attack complexity requiring user interaction.

Technical ContextAI

Mailcow: dockerized is a containerized open-source email and groupware suite running on Docker. The vulnerability resides in the Quarantine details modal component of the administrative web interface, which displays metadata about quarantined emails including attachment filenames. The application fails to perform HTML entity encoding or sanitization before inserting attachment filenames into the DOM, creating a classic stored XSS (CWE-79) vulnerability. Because quarantine items are stored server-side and rendered upon administrator access, this is a stored/persistent XSS rather than reflected. The vulnerability affects the CPE-identified product cpe:2.3:a:mailcow:mailcow-dockerized across all versions prior to the 2026-03b release, which introduced proper output encoding for user-controlled attachment name fields.

RemediationAI

Upgrade immediately to mailcow: dockerized version 2026-03b or later, which implements proper HTML escaping for attachment filenames in the quarantine details modal. Download from the official GitHub repository following standard mailcow upgrade procedures for Docker-based deployments. Vendor advisory at https://github.com/mailcow/mailcow-dockerized/security/advisories/GHSA-2xjc-rg88-jvpp confirms fix availability and includes upgrade guidance. If immediate patching is not feasible, implement these compensating controls with noted trade-offs: (1) Restrict quarantine management interface access to trusted IP ranges via reverse proxy rules or firewall ACLs-reduces attack surface but doesn't prevent exploitation by compromised legitimate administrators. (2) Disable automatic quarantine retention and rely solely on real-time spam filtering-eliminates vulnerable code path entirely but removes quarantine review capability for false positive recovery. (3) Implement Content Security Policy headers blocking inline JavaScript execution on admin interface-mitigates XSS impact but may break legitimate mailcow functionality and requires testing. All workarounds provide partial risk reduction only; vendor patch is the definitive solution.