What is GHSA-4wpv-p8hj-wr36?

GHSA-4wpv-p8hj-wr36 is a security advisory published by GitHub Security Advisories with High severity. mailcow-dockerized contains a stored cross-site scripting vulnerability in the administrator...

Which CVE IDs does GHSA-4wpv-p8hj-wr36 cover?

GHSA-4wpv-p8hj-wr36 covers the following CVE IDs: CVE-2026-7460. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

GHSA-4wpv-p8hj-wr36High

mailcow-dockerized contains a stored cross-site scripting vulnerability in the administrator...

Vendor

GitHub Security Advisories

Published

May 20, 2026

Last Modified

May 20, 2026

🔗 CVE IDs covered (1)

CVE-2026-7460 →

📋 Description

mailcow-dockerized contains a stored cross-site scripting vulnerability in the administrator Queue Manager. The Queue Manager fetches mail queue entries from /api/v1/get/mailq/all, copies server-controlled Postfix queue fields into DataTables rows, and renders several of those fields as HTML without adequate output encoding. This issue affects mailcow-dockerized: 2026-03b.

🔗 References (4)

https://nvd.nist.gov/vuln/detail/CVE-2026-7460
https://fluidattacks.com/advisories/mojabi
https://github.com/mailcow/mailcow-dockerized
https://github.com/advisories/GHSA-4wpv-p8hj-wr36