In mailcow‑dockerized versions before 2026‑03b, the Quarantine details modal injects attachment filenames directly into the page’s HTML without escaping. An attacker can craft an email with a malicious attachment name, and when an administrator opens the quarantine record, the browser executes the injected code. This results in a complete compromise of the administrator’s account and any privileges the web interface confers.

The flaw affects the mailcow‑dockerized suite. Any deployment of the open source groupware/email system that has not upgraded beyond the 2026‑03b release is vulnerable.

The CVSS score of 8.9 indicates high severity. The EPSS score is not available, but the vulnerability is known to be actionable and is not yet listed in CISA’s KEV catalog, suggesting exploitation is possible yet not widely observed. Likely attack vectors involve the attacker sending a crafted email and the administrator subsequently viewing the quarantine modal in a browser.