CVE-2025-49136
CRITICALlistmonk 4.0.0-5.0.1 - Unauthenticated Sensitive Environment Variable Exposure via Template Function
Title source: llmExploitation Summary
EIP tracks 1 public exploit for CVE-2025-49136.
PoCs published by Tarek Nakkouch, including Metasploit module auxiliary/gather/listmonk_env_disclosure.
AI-analyzed exploit summary This Metasploit module exploits insecure Sprig template functions in Listmonk to disclose environment variables via authenticated campaign preview. It leverages the `env` and `expandenv` functions to extract sensitive data.
Description
listmonk is a standalone, self-hosted, newsletter and mailing list manager. Starting in version 4.0.0 and prior to version 5.0.2, the `env` and `expandenv` template functions which is enabled by default in Sprig enables capturing of env variables on host. While this may not be a problem on single-user (super admin) installations, on multi-user installations, this allows non-super-admin users with campaign or template permissions to use the `{{ env }}` template expression to capture sensitive environment variables. Users should upgrade to v5.0.2 to mitigate the issue.
Exploits (1)
This Metasploit module exploits insecure Sprig template functions in Listmonk to disclose environment variables via authenticated campaign preview. It leverages the `env` and `expandenv` functions to extract sensitive data.
References (3)
Scores
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H