CVE-2026-40878: mailcow dockerized XSS Vulnerability

CVE-2026-40878 Overview

CVE-2026-40878 is a Cross-Site Scripting (XSS) vulnerability affecting mailcow: dockerized, an open source groupware and email suite based on Docker. The vulnerability exists in the web interface where the raw $_SERVER['REQUEST_URI'] is passed to Twig as a global template variable and rendered inside a JavaScript string literal in the setLang() helper of base.twig. The application relies on Twig's default HTML auto-escaping instead of the context-appropriate js escaping strategy, which allows attackers to inject malicious scripts.

Additionally, the query_string() Twig helper merges all current $_GET parameters into the language-switching links on the login page, causing attacker-supplied parameters to be reflected and preserved across navigation.

Critical Impact

Attackers can execute arbitrary JavaScript in victim browsers through crafted URLs on the mailcow login page, potentially leading to session hijacking, credential theft, or other malicious actions against authenticated users.

Affected Products

• mailcow: dockerized versions prior to 2026-03b

Discovery Timeline

• 2026-04-21 - CVE CVE-2026-40878 published to NVD
• 2026-04-22 - Last updated in NVD database

Technical Details for CVE-2026-40878

Vulnerability Analysis

This vulnerability is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation), commonly known as Cross-Site Scripting (XSS). The flaw originates from insufficient output encoding when user-controlled input is rendered within a JavaScript context in the Twig templating engine.

The core issue lies in how the mailcow web interface handles the REQUEST_URI server variable. When this value is passed to the Twig template engine and rendered inside a JavaScript string literal within the setLang() helper function, Twig applies HTML auto-escaping by default. However, HTML escaping is insufficient for JavaScript contexts, where attackers can break out of string literals using characters that are valid in HTML but dangerous in JavaScript.

Root Cause

The root cause is the use of inappropriate escaping context in the Twig template engine. The base.twig template renders user-controlled input ($_SERVER['REQUEST_URI']) inside a JavaScript string literal without applying the js escaping strategy. Twig's default HTML auto-escaping does not protect against JavaScript injection attacks because different contexts require different escaping rules.

Furthermore, the query_string() Twig helper function compounds this issue by merging all $_GET parameters into language-switching links, allowing attacker-supplied parameters to persist and be reflected across page navigations on the login page.

Attack Vector

The attack is network-based and requires user interaction. An attacker can craft a malicious URL containing JavaScript payload within the query string or request URI. When a victim clicks this URL and visits the mailcow login page, the malicious JavaScript is rendered within the setLang() function and executed in the victim's browser context.

The vulnerability is particularly concerning because the reflected parameters persist across language-switching navigation, making the attack more reliable. An attacker could distribute the malicious URL via phishing emails or social engineering to target mailcow administrators or users.

Detection Methods for CVE-2026-40878

Indicators of Compromise

• Unusual or suspicious URLs containing JavaScript code in query parameters targeting the mailcow login page
• Web server logs showing requests with encoded or unencoded <script> tags or JavaScript event handlers in the URI
• Reports from users of unexpected browser behavior or pop-ups when accessing the mailcow interface

Detection Strategies

• Monitor web application logs for requests containing suspicious patterns like javascript:, <script>, onerror=, onload=, or other XSS payload signatures
• Implement Content Security Policy (CSP) headers and monitor for CSP violation reports
• Deploy web application firewall (WAF) rules to detect and block common XSS attack patterns in request URIs and query strings
• Review Twig template rendering for proper escaping strategies, especially in JavaScript contexts

Monitoring Recommendations

• Enable verbose logging on the mailcow web server to capture full request URIs
• Set up alerting for unusual patterns in query strings, particularly those containing script-like content
• Monitor for any unauthorized modifications to Twig template files

How to Mitigate CVE-2026-40878

Immediate Actions Required

• Upgrade mailcow: dockerized to version 2026-03b or later immediately
• Review web server access logs for any evidence of exploitation attempts
• Implement Content Security Policy (CSP) headers as a defense-in-depth measure
• Consider temporarily restricting access to the mailcow web interface from untrusted networks until patching is complete

Patch Information

The vulnerability has been fixed in mailcow: dockerized version 2026-03b. Users should update their installations to this version or later to remediate the vulnerability. For detailed information about the fix, refer to the GitHub Security Advisory.

Workarounds

• Implement a Web Application Firewall (WAF) to filter malicious requests containing XSS payloads
• Deploy Content Security Policy headers with strict script-src directives to mitigate the impact of successful XSS attacks
• Restrict network access to the mailcow web interface to trusted IP ranges or VPN users only
• Educate users about the risks of clicking suspicious links, especially those targeting the mailcow login page

# Example CSP header configuration for nginx (defense-in-depth)
add_header Content-Security-Policy "default-src 'self'; script-src 'self'; object-src 'none'; frame-ancestors 'none';" always;