CVE-2022-31245: Mailcow Mailcow: Dockerized

High severity, CVSS 8.8. EPSS: 5.5% chance of exploitation in the next 30 days.

mailcow before 2022-05d allows a remote authenticated user to inject OS commands and escalate privileges to domain admin via the --debug option in conjunction with the ---PIPEMESS option in Sync Jobs.

Affected products

• Mailcow Mailcow: Dockerized: before 2022-05d (fixed in 2022-05d)

Published 2022-05-20. Last modified 2026-06-17.