CVE-2024-30270

mediumpriority · track · 20EPSS 0.273 · 98 %ileexploit · PoCEURUUS

grimoire priorityP1 · Urgent

Exploitable?

Public exploit

1 exploit · PoC

Likely / severe?

27.3% (98th) EPSS

CVSS 6.7 · medium

Is it mine?

4 products

Check your exposure

Who says so?

4 sources

cnnvd · enisa_euvd · fstec_bdu · nvd

EPSS · scored 2026-10-26

mailcow: dockerized is an open source groupware/email suite based on docker. A security vulnerability has been identified in mailcow affecting versions prior to 2024-04. This vulnerability is a combination of path traversal and arbitrary code execution, specifically targeting the `rspamd_maps()` function. It allows authenticated admin users to overwrite any file writable by the www-data user by exploiting improper path validation. The exploit chain can lead to the execution of arbitrary commands on the server. Version 2024-04 contains a patch for the issue.

cvss

Technical severity, 0–10. One row per scoring source.

6.7

010

base score 0–10 · higher = more severe · hover a vector to decode

v3.16.7mediumAV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:Lsecondary · FSTEC (BDU) RU

v3.16.2mediumCVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:Lsecondary · ENISA EU

v3.16.2mediumCVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:Lsecondary · security-advisories@github.comexploitability 0.7 · impact 5.5

v3.15.9mediumCVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:L/E:Psecondary · CVSS-BT (t0sche)

ssvc

A stakeholder decision — act, attend, or track — from exploitation and impact.

Trackcoordinatorcisa_ssvcUS

weaknesses

The CWE weakness classes this flaw belongs to.

CWE-22USCWE-22US

exploits (1)

Public proof-of-concept and weaponised exploit code.

Alchemist3dot14/CVE-2024-30270-PoCThe script exploits Mailcow vulnerabilities via XSS and RCE, emphasizing the need for robust security measures and responsible usage to enhance web application security.PoC · poc_in_github

affected products (4)

Products and version ranges known to be affected.

mailcow mailcow-dockerizedall versionsenisa_euvdEU
mailcow mailcow-dockerized≤ < 2024-04enisa_euvdEU
Сообщество свободного программного обеспечения mailcow:dockerized≤ 2024-04fstec_bduRU
mailcow mailcow: dockerized< 2024-04nvdUScpe:2.3:a:mailcow:mailcow\:_dockerized:*:*:*:*:*:*:*:*

also known as (3)

Other names and identifiers for this entity.

sources

Which sources assert this record, and when.

cnnvd enisa_euvd fstec_bdu nvd NVD CVE.org MITRE

published 2024-04-04modified 2026-06-17

references (11)

External citations — patches, advisories, analysis.

scry

Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.

Free scan