CVE-2024-30270

mailcow: dockerized is an open source groupware/email suite based on docker. A security vulnerability has been identified in mailcow affecting versions prior to 2024-04. This vulnerability is a combination of path traversal and arbitrary code execution, specifically targeting the `rspamd_maps()` function. It allows authenticated admin users to overwrite any file writable by the www-data user by exploiting improper path validation. The exploit chain can lead to the execution of arbitrary commands on the server. Version 2024-04 contains a patch for the issue.

• CWE-22

• https://github.com/mailcow/mailcow-dockerized/security/advisories/GHSA-4m8r-87gc-3vvpVendor Advisory
• https://mailcow.email/posts/2024/release-2024-04Release Notes
• https://www.sonarsource.com/blog/remote-code-execution-in-mailcow-always-sanitize-error-messagesExploit, Third Party Advisory
• https://github.com/mailcow/mailcow-dockerized/security/advisories/GHSA-4m8r-87gc-3vvpVendor Advisory
• https://mailcow.email/posts/2024/release-2024-04Release Notes
• https://www.vicarius.io/vsociety/posts/mailcow-with-xss-and-path-traversal-cve-2024-31204-and-cve-2024-30270Exploit, Third Party Advisory

Published

Apr 4, 2024

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2024-30264Typebot is an open-source chatbot builder. A reflected cross…9.3
• CVE-2024-30265Collabora Online is a collaborative online office suite base…7.5
• CVE-2024-30266wasmtime is a runtime for WebAssembly. The 19.0.0 release of…5.5
• CVE-2024-30268Cacti provides an operational monitoring and fault managemen…6.1
• CVE-2024-30269DataEase, an open source data visualization and analysis too…5.3
• CVE-2024-3027The Smart Slider 3 plugin for WordPress is vulnerable to una…6.4
• CVE-2024-30271Illustrator versions 28.3, 27.9.2 and earlier are affected b…7.8
• CVE-2024-30272Illustrator versions 28.3, 27.9.2 and earlier are affected b…7.8
• CVE-2024-30273Illustrator versions 28.3, 27.9.2 and earlier are affected b…7.8
• CVE-2024-30274Substance3D - Painter versions 9.1.2 and earlier are affecte…7.8
• CVE-2024-30275Adobe Aero Desktop versions 23.4 and earlier are affected by…7.8
• CVE-2024-30276Audition versions 24.2, 23.6.4 and earlier Answer: are affec…5.5