Mailcow‑dockerized versions earlier 2026‑03b incorrectly render the raw request URI inside a JavaScript string literal in the base.twig template. Because Twig’s default HTML auto‑escaping is applied instead of JavaScript‑specific escaping, an attacker can inject arbitrary JavaScript that will execute when a victim visits the login page. This reflected parameter injection flaw can lead to credential theft, session hijacking, or other client‑side attacks, and maps to CWE‑79.

The vulnerability affects any deployment of mailcow‑dockerized running version 2026‑03b or earlier. The vendor has released 2026‑03b which removes the unsafe rendering of REQUEST_URI from the template.

The CVSS score of 2.1 indicates low severity, and the EPSS score of less than 1% suggests a very low probability of exploitation. The flaw is not listed in CISA KEV. Exploitation requires only that a victim opens a crafted URL pointing to the login page; no authentication or privileged state is needed. While the risk is low absent a social‑engineering campaign, the exposure warrants timely patching to eliminate the XSS surface.