CVE-2023-26490 (mailcow:_dockerized)

mailcow is a dockerized email package, with multiple containers linked in one bridged network. The Sync Job feature - which can be made available to standard users by assigning them the necessary permission - suffers from a shell command injection. A malicious user can abuse this vulnerability to obtain shell access to the Docker container running dovecot. The imapsync Perl script implements all the necessary functionality for this feature, including the XOAUTH2 authentication mechanism. This code path creates a shell …

abuse access authentication code command command injection container containers cve docker dovecot email injection job malicious network package path perl permission script shell standard sync vulnerability