CVE-2025-49136
high-risk
Published 2025-06-09
listmonk is a standalone, self-hosted, newsletter and mailing list manager. Starting in version 4.0.0 and prior to version 5.0.2, the `env` and `expandenv` template functions which is enabled by default in Sprig enables capturing of env variables on host. While this may not be a problem on single-user (super admin) installations, on multi-user installations, this allows non-super-admin users with campaign or template permissions to use the `{{ env }}` template expression to capture sensitive environment variables. Users should upgrade to v5.0.2 to mitigate the issue.
Do I need to act?
!
61.8% chance of exploitation in next 30 days
EPSS score — higher than 38% of all CVEs
-
Not on CISA KEV list
No confirmed active exploitation reported to CISA
?
Patch status unknown
Check vendor advisories for fix availability and mitigation guidance
9
CVSS 9.0/10
Critical
NETWORK
/ LOW complexity
Affected Products (1)
Listmonk
Affected Vendors
References (4)
Release Notes
https://github.com/knadh/listmonk/releases/tag/v5.0.2
54
/ 100
high-risk
Severity
30/34 · Critical
Exploitability
19/34 · Moderate
Exposure
5/34 · Minimal