CVE-2024-30270: Mailcow Mailcow: Dockerized

Medium severity, CVSS 6.2. EPSS: 27.3% chance of exploitation in the next 30 days.

mailcow: dockerized is an open source groupware/email suite based on docker. A security vulnerability has been identified in mailcow affecting versions prior to 2024-04. This vulnerability is a combination of path traversal and arbitrary code execution, specifically targeting the `rspamd_maps()` function. It allows authenticated admin users to overwrite any file writable by the www-data user by exploiting improper path validation. The exploit chain can lead to the execution of arbitrary commands on the server. Version 2024-04 contains a patch for the issue.

Affected products

• Mailcow Mailcow: Dockerized: before 2024-04 (fixed in 2024-04)

Published 2024-04-04. Last modified 2026-06-17.