https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Fri, 02 Oct 2026 21:13:34 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-243597 EUVD-2026-243597 https://cve.radiocsirt.org/vuln/euvd-2026-243597 https://cve.radiocsirt.org/vuln/fkie_cve-2025-49136 <p>listmonk is a standalone, self-hosted, newsletter and mailing list manager. Starting in version 4.0.0 and prior to version 5.0.2, the `env` and `expandenv` template functions which is enabled by default in Sprig enables capturing of env variables on host. While this may not be a problem on single-user (super admin) installations, on multi-user installations, this allows non-super-admin users with campaign or template permissions to use the `{{ env }}` template expression to capture sensitive environment variables. Users should upgrade to v5.0.2 to mitigate the issue.</p> <p>listmonk is a standalone, self-hosted, newsletter and mailing list manager. Starting in version 4.0.0 and prior to version 5.0.2, the `env` and `expandenv` template functions which is enabled by default in Sprig enables capturing of env variables on host. While this may not be a problem on single-user (super admin) installations, on multi-user installations, this allows non-super-admin users with campaign or template permissions to use the `{{ env }}` template expression to capture sensitive environment variables. Users should upgrade to v5.0.2 to mitigate the issue.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2025-49136 https://cve.radiocsirt.org/vuln/ghsa-jc7g-x28f-3v3h <p><strong>Affected:</strong> Go: github.com/knadh/listmonk</p> <p>### Summary The `env` and `expandenv` template functions which is enabled by default in [Sprig](https://masterminds.github.io/sprig/) enables capturing of env variables on the host. While this may not be a problem on single-user (super admin) installations, on multi-user installations, this allows non-super-admin users with campaign or template permissions to use the `{{ env }}` template expression to capture sensitive environment variables.</p> <p>**Upgrade to [v5.0.2](https://github.com/knadh/listmonk/releases/tag/v5.0.2)** to mitigate.</p> <p>---------</p> <p># Demonstration</p> <p>### Description A critical template injection vulnerability exists in Listmonk&#39;s campaign preview functionality that allows authenticated users with minimal privileges (campaigns:get &amp; campaigns:get_all) to extract sensitive system data, including database credentials, SMTP passwords, and admin credentials due to some dangerous function being allowed.</p> <p>### Proof of Concept</p> <p>- Create a user and give him `campaigns:get` and `campaigns:get_all` privileges</p> <p></p> <p>- Now login with that user, go to any campaign, go the Content section and here lies the vulnerability, we&#39;re able to execute template content which allows us to get environment variables, execute Sprig functions...</p> <p>- Now in the text field you can input the following and press Preview: ``` {{ env &#34;AWS_KEY&#34; }} {{ env &#34;LISTMONK_db__user&#34; }} {{ env &#34;LISTMONK_db__password&#34; }} ````…</p> <p><strong>Affected:</strong> Go: github.com/knadh/listmonk</p> <p>### Summary The `env` and `expandenv` template functions which is enabled by default in [Sprig](https://masterminds.github.io/sprig/) enables capturing of env variables on the host. While this may not be a problem on single-user (super admin) installations, on multi-user installations, this allows non-super-admin users with campaign or template permissions to use the `{{ env }}` template expression to capture sensitive environment variables.</p> <p>**Upgrade to [v5.0.2](https://github.com/knadh/listmonk/releases/tag/v5.0.2)** to mitigate.</p> <p>---------</p> <p># Demonstration</p> <p>### Description A critical template injection vulnerability exists in Listmonk&#39;s campaign preview functionality that allows authenticated users with minimal privileges (campaigns:get &amp; campaigns:get_all) to extract sensitive system data, including database credentials, SMTP passwords, and admin credentials due to some dangerous function being allowed.</p> <p>### Proof of Concept</p> <p>- Create a user and give him `campaigns:get` and `campaigns:get_all` privileges</p> <p></p> <p>- Now login with that user, go to any campaign, go the Content section and here lies the vulnerability, we&#39;re able to execute template content which allows us to get environment variables, execute Sprig functions...</p> <p>- Now in the text field you can input the following and press Preview: ``` {{ env &#34;AWS_KEY&#34; }} {{ env &#34;LISTMONK_db__user&#34; }} {{ env &#34;LISTMONK_db__password&#34; }} ````…</p> https://cve.radiocsirt.org/vuln/ghsa-jc7g-x28f-3v3h https://cve.radiocsirt.org/vuln/opensuse-su-2025:15225-1 <p>govulncheck-vulndb-0.0.20250612T141001-1.1 on GA media</p> <p>govulncheck-vulndb-0.0.20250612T141001-1.1 on GA media</p> https://cve.radiocsirt.org/vuln/opensuse-su-2025:15225-1