mailcow-dockerized Login Page has Reflected Parameter Injection / Wrong-Context XSS Escaping

mailcow: dockerized is an open source groupware/email suite based on docker. In versions prior to 2026-03b, the mailcow web interface passes the raw `$_SERVER['REQUEST_URI']` to Twig as a global template variable and renders it inside a JavaScript string literal in the `setLang()` helper of `base.twig`, relying on Twig's default HTML auto-escaping instead of the context-appropriate `js` escaping strategy. In addition, the `query_string()` Twig helper merges all current `$_GET` parameters into the language-switching links on the login page, so attacker-supplied parameters are reflected and preserved across navigation. Version 2026-03b fixes the vulnerability.

N/A

在Web页面生成时对输入的转义处理不恰当(跨站脚本)

mailcow: dockerized 跨站脚本漏洞

mailcow: dockerized是mailcow开源的一个docker化的mailcow应用软件。 mailcow: dockerized 2026-03b之前版本存在跨站脚本漏洞，该漏洞源于Web界面将原始$_SERVER[ REQUEST_URI ]传递给Twig作为全局模板变量，并在JavaScript字符串字面量中渲染，且query_string助手合并所有当前$_GET参数到语言切换链接，可能导致跨站脚本攻击。

N/A

N/A