CVE-2024-30270

This vulnerability is like a “locked door with a shortcut”: instead of only being allowed to change a safe location, a malicious user with the right admin access could trick the system into writing to other files and then running code. For a mail server, that can mean attackers take control of the server or disrupt your email operations. The good news is that a fix exists in the 2024-04 release.

This matters if you run mailcow-dockerized (mailcow:dockerized) with a version earlier than 2024-04. Because the vulnerable behavior requires an authenticated admin user path, it’s mainly a risk when an attacker can get admin credentials or when an existing admin account is compromised. It becomes a higher concern if your admin login interface is reachable from the internet and not tightly restricted.

Treat this as urgent but not “panic”: it’s in the amber range because the vulnerability can lead to serious impact (arbitrary code execution) and there is a public exploit available. However, the exploit requires an authenticated admin context, so the key question is whether you’re exposed to compromised admin access. Update to 2024-04 promptly and tighten admin access immediately.

1. Confirm exposure

• Determine your running version of mailcow-dockerized.
• If it is earlier than 2024-04, you are in the vulnerable range.

2. Upgrade to the fixed version

• Upgrade to the mailcow-dockerized release containing the fix (2024-04).
• Use the vendor remediation guidance from the mailcow advisory GHSA-4m8r-87gc-3vvp and their 2024-04 release post.

3. Validate after upgrade

• Confirm the mailcow container/service versions match the 2024-04 release.
• Check that routine mail functions (receiving/sending) still work normally.

4. Interim containment if you can’t upgrade immediately

• Restrict admin login access so it’s not broadly reachable (for example, allowlist only your VPN/office IPs).
• Ensure admin credentials are strong and rotate any passwords if you suspect credential exposure.

5. What to monitor

• Look for unexpected changes to files under paths writable by www-data.
• Review authentication logs for suspicious admin logins and unusual source IPs.
• Check for process execution patterns that aren’t normal for your mailcow workload.

6. Timeline note

• This issue is patched in 2024-04 per the vendor fix information provided in the findings. (No KEV listing was provided.)

CVE-2024-30270 (CWE-22) affects mailcow-dockerized/mailcow:dockerized versions prior to 2024-04. The flaw is a path traversal that can be used to overwrite any file writable by the www-data user via the rspamd_maps() function, and the resulting overwrite can be chained to arbitrary code execution. Public exploitation exists (1 known public exploit), which supports treating it as actionable despite the available CVSS score being medium. The findings did not indicate KEV listing by CISA. EPSS is available as a prediction only and is not used as the basis for urgency per the provided verdict guidance; the primary driver here is the existence of a public exploit and the nature of the impact. Recommended target is the patched 2024-04 release as referenced in the vendor advisory GHSA-4m8r-87gc-3vvp.