EUVD-2026-24258Severity by source
CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:P/VC:H/VI:N/VA:N/SC:H/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Primary rating from GitHub Advisory · only source for this CVE.
CVSS VectorGitHub Advisory
CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:P/VC:H/VI:N/VA:N/SC:H/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
8DescriptionGitHub Advisory
mailcow: dockerized is an open source groupware/email suite based on docker. In versions prior to 2026-03b, the user dashboard's "Seen successful connections" (login history) renders the client IP from login logs without HTML escaping. Because the server trusts the X-Real-IP header as the source IP for logging, an attacker can inject HTML/JS into this field. This Self-XSS can be exploited by a Login CSRF to force the victim into the attacker's account, and then read emails in a previous browser tab. Version 2026-03b fixes the vulnerability.
AnalysisAI
Cross-site scripting in mailcow dockerized versions prior to 2026-03b enables remote attackers to execute malicious JavaScript in victim browsers through a chained Login CSRF and Self-XSS attack. Exploitation requires low-privileged attacker credentials and victim interaction, but can result in unauthorized access to victim email accounts and session hijacking (CVSS 7.0, AV:N/AC:H/PR:L/UI:P). The vulnerability stems from insufficient HTML escaping of X-Real-IP header values in the login history dashboard, combined with server trust of client-supplied IP headers. No active exploitation or public POC identified at time of analysis, but technical details disclosed via GitHub Security Advisory make weaponization feasible.
Technical ContextAI
The vulnerability affects mailcow dockerized (CPE: cpe:2.3:a:mailcow:mailcow-dockerized), a containerized email groupware suite deployed via Docker. The root cause is improper neutralization of input during web page generation (CWE-79, classic stored XSS). The application's login logging mechanism captures the client IP address from the X-Real-IP HTTP header - a reverse proxy header commonly used in Docker deployments behind nginx or similar load balancers. This header value is stored in login history without sanitization and later rendered in the user dashboard's 'Seen successful connections' interface without HTML escaping. Because HTTP headers are fully attacker-controlled, this creates a stored XSS sink. The trust in client-supplied headers is a common misconfiguration in containerized environments where developers assume reverse proxy headers are authoritative without validating their source.
RemediationAI
Upgrade immediately to mailcow dockerized version 2026-03b or later, which implements proper HTML escaping for login history display fields. Download the patched release from the official mailcow GitHub repository. The upgrade process follows standard mailcow update procedures via docker-compose pull and restart. For installations unable to upgrade immediately, implement these compensating controls with noted limitations: First, restrict mailcow dashboard access to trusted networks only via firewall rules or VPN requirements - this reduces attack surface but does not eliminate insider threat risk. Second, configure the reverse proxy (nginx/Traefal/HAProxy) to strip or sanitize X-Real-IP and X-Forwarded-For headers from untrusted sources, replacing them with the actual TCP connection IP - however, this breaks legitimate IP geolocation and may interfere with rate limiting based on client IP. Third, disable the login history feature in the user dashboard if the codebase allows - this eliminates the XSS sink but reduces security visibility for users. None of these workarounds are complete mitigations; the vendor patch is required for full resolution. Consult the GitHub Security Advisory at https://github.com/mailcow/mailcow-dockerized/security/advisories/GHSA-jprq-w83q-q62h for detailed remediation guidance and release notes.
An issue was discovered in Appsmith before 1.52. Rated critical severity (CVSS 9.8), this vulnerability is remotely expl
runc through version 1.0-rc6 (used in Docker before 18.09.2) contains a container escape vulnerability that allows attac
Netmaker makes networks with WireGuard. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no a
Unauthenticated remote code execution in Marimo ≤0.20.4 allows attackers to execute arbitrary system commands via the `/
The News & Blog Designer Pack - WordPress Blog Plugin - (Blog Post Grid, Blog Post Slider, Blog Post Carousel, Blog Post
Docker 1.3.2 allows remote attackers to execute arbitrary code with root privileges via a crafted (1) image or (2) build
Remote code execution in NocoBase Workflow Script Node (npm @nocobase/plugin-workflow-javascript) allows authenticated l
Docker Desktop Community Edition before 2.1.0.1 allows local users to gain privileges by placing a Trojan horse docker-c
Vasion Print (formerly PrinterLogic) Virtual Appliance Host prior to version 25.2.169 and Application prior to version 2
An issue in Plone Docker Official Image 5.2.13 (5221) open-source software that could allow for remote code execution du
Tandoor Recipes is an application for managing recipes, planning meals, and building shopping lists. Rated critical seve
Unauthenticated remote code execution in 9router (npm package) versions 0.4.30 through 0.4.36 allows network-adjacent at
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today