mailcow Path Traversal and Arbitrary Code Execution Vulnerability
Résumé
mailcow Path Traversal and Arbitrary Code Execution Vulnerability
Description d'origine
La description telle que publiée par la source (souvent en anglais).
mailcow: dockerized is an open source groupware/email suite based on docker. A security vulnerability has been identified in mailcow affecting versions prior to 2024-04. This vulnerability is a combination of path traversal and arbitrary code execution, specifically targeting the rspamd_maps() function. It allows authenticated admin users to overwrite any file writable by the www-data user by exploiting improper path validation. The exploit chain can lead to the execution of arbitrary commands on the server. Version 2024-04 contains a patch for the issue.
Source: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV
Références
- advisory github.com
- advisory github.com
- advisory nvd.nist.gov
- web mailcow.email
- web vicarius.io
- web sonarsource.com