CVE-2025-49136
- Source
- https://nvd.nist.gov/vuln/detail/CVE-2025-49136
- Import Source
- https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-49136.json
- JSON Data
- https://api.osv.dev/v1/vulns/CVE-2025-49136
- Aliases
- Published
- 2025-06-09T16:21:48.266Z
- Modified
- 2025-12-05T10:18:30.155835Z
- Severity
-
- 9.0 (Critical) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H CVSS Calculator
- Summary
- listmonk's Sprig template Injection vulnerability leads to reading of Environment Variable for low privilege user
- Details
-
listmonk is a standalone, self-hosted, newsletter and mailing list manager. Starting in version 4.0.0 and prior to version 5.0.2, the
envandexpandenvtemplate functions which is enabled by default in Sprig enables capturing of env variables on host. While this may not be a problem on single-user (super admin) installations, on multi-user installations, this allows non-super-admin users with campaign or template permissions to use the{{ env }}template expression to capture sensitive environment variables. Users should upgrade to v5.0.2 to mitigate the issue. - Database specific
{ "cna_assigner": "GitHub_M", "cwe_ids": [ "CWE-1336" ], "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/49xxx/CVE-2025-49136.json" }- References
-
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/49xxx/CVE-2025-49136.json
- https://github.com/knadh/listmonk/commit/d27d2c32cf3af2d0b24e29ea5a686ba149b49b3e
- https://github.com/knadh/listmonk/releases/tag/v5.0.2
- https://github.com/knadh/listmonk/security/advisories/GHSA-jc7g-x28f-3v3h
- https://nvd.nist.gov/vuln/detail/CVE-2025-49136