Mailcow < 2026-03b - Href Link Injection

lowseverity

3.1CVSS score

0.8%likelihood of exploitation, next 30 days

57%of all CVEs are less likely

Readycheck to confirm it

mailcow < 2026-03b reflects raw REQUEST_URI into JavaScript and href links on the login page, allowing attackers to inject parameters that break JS logic and enable phishing.

Impact

Unauthenticated parameter injection into JavaScript and href attributes on the login page. Enables phishing, open-redirect chaining, and JS logic corruption (DoS of FIDO2/WebAuthn and CSRF handlers) via backslash injection.

Fix

Upgrade to mailcow 2026-03b or later.

How to confirm it

Send: GET {{BaseURL}}/?session_expired=true&redirect=http://evil.com
Positive when: contains "function setLang" and "$.post( '/?session_expired=true&amp;redirect=http://evil.com" AND status 200

Run it with nuclei: nuclei -id CVE-2026-40878 -u <target>

The full check

id: CVE-2026-40878

info:
  name: Mailcow < 2026-03b - Href Link Injection
  author: ritikchaddha
  severity: low
  description: |
    mailcow < 2026-03b reflects raw REQUEST_URI into JavaScript and href links on the login page, allowing attackers to inject parameters that break JS logic and enable phishing.
  impact: |
    Unauthenticated parameter injection into JavaScript and href attributes on the login page. Enables phishing, open-redirect chaining, and JS logic corruption (DoS of FIDO2/WebAuthn and CSRF handlers) via backslash injection.
  remediation: |
    Upgrade to mailcow 2026-03b or later.
  reference:
    - https://github.com/mailcow/mailcow-dockerized/security/advisories/GHSA-xv9r-j862-5hqf
    - https://github.com/mailcow/mailcow-dockerized
    - https://nvd.nist.gov/vuln/detail/CVE-2026-40878
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:L
    cvss-score: 3.1
    cve-id: CVE-2026-40878
    epss-score: 0.00805
    epss-percentile: 0.57094
  metadata:
    verified: true
    max-request: 2
    vendor: mailcow
    product: mailcow-dockerized
    shodan-query: http.favicon.hash:2146763496
    fofa-query: title="mailcow"
  tags: cve,cve2026,mailcow,link-injection

http:
  - method: GET
    path:
      - "{{BaseURL}}/?session_expired=true&redirect=http://evil.com"

    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - "function setLang"
          - "$.post( '/?session_expired=true&amp;redirect=http://evil.com"
        condition: and

      - type: status
        status:
          - 200

References

Use this check only on systems you are authorised to test. Where the data comes from