CVE-2025-49136: CVE-2025-49136: listmonk is a standalone, self-hosted, newsletter and mailing list manager. Starting in ve…
nadh · listmonk · NVD published 2025-06-09 · posted 2025-06-08 · last modified 2026-06-17
What it is
listmonk is a standalone, self-hosted, newsletter and mailing list manager. Starting in version 4.0.0 and prior to version 5.0.2, the `env` and `expandenv` template functions which is enabled by default in Sprig enables capturing of env variables on host. While this may not be a problem on single-user (super admin) installations, on multi-user installations, this allows non-super-admin users with campaign or template permissions to use the `{{ env }}` template expression to capture sensitive environment variables. Users should upgrade to v5.0.2 to mitigate the issue.
| Weakness | CWE-1336 |
|---|---|
| CVSS vector | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N (source: [email protected]) |
| ATT&CK tactics | Initial Access → Execution |
Exploitation evidence
First exploit evidence seen: 2025-06-08 (earliest date across the sources below).
Exploited in the wild
No source on this site lists in-the-wild exploitation yet (CISA KEV, VulnCheck KEV).
Public exploit code
Metasploit
auxiliary/gather/listmonk_env_disclosure: Listmonk Insecure Sprig Template Functions Environment Disclosure (disclosure 2025-06-08)
Sources: Rapid7 Metasploit Framework module metadata.
Defend the Chain
The attack chain for CVE-2025-49136 laid across the MITRE ATT&CK Enterprise tactics. Solid cards come from the MITRE CTID KEV mappings; dashed cards are inferred by CVERadar from the CWE or description. Correct defences are real ATT&CK mitigations for that technique.
Pick a red technique card on the board, then choose the defence that stops it.
Defend against T1190 Exploit Public-Facing Application Inferred
Inferred from CWE CWE-1336
How to fix it
Fixed versions
- nadh listmonk: upgrade to 5.0.2 or later (affected from 4.0.0)
Derived from the NVD CPE configuration (versionEndExcluding / versionEndIncluding). Always confirm with the vendor advisory.
Vendor advisories and patches
- https://github.com/knadh/listmonk/commit/d27d2c32cf3af2d0b24e29ea5a686ba149b49b3e (Patch)
- https://github.com/knadh/listmonk/releases/tag/v5.0.2 (Release Notes)
- https://github.com/knadh/listmonk/security/advisories/GHSA-jc7g-x28f-3v3h (Exploit, Vendor Advisory)
MITRE ATT&CK mitigations for this chain
- M1048 Application Isolation and Sandboxing (for T1190) : Application isolation will limit what other processes and system features the exploited target can access.
- M1037 Filter Network Traffic (for T1190) : Restrict outbound network traffic from public-facing servers to prevent unauthorized connections from initiating communications with attacker-controlled infrastructure. While this may not prevent the initial exploitation, it limits the attacker's ability to verify and control the compromised server post-exploit, reduci
- M1030 Network Segmentation (for T1190) : Segment externally facing servers and services from the rest of the network with a DMZ or on separate hosting infrastructure.
- M1016 Vulnerability Scanning (for T1190) : Regularly scan externally facing systems for vulnerabilities and establish procedures to rapidly patch systems when critical vulnerabilities are discovered through scanning and through public disclosure.
- M1026 Privileged Account Management (for T1190, T1059) : Use least privilege for service accounts will limit what permissions the exploited process gets on the rest of the system.
- M1050 Exploit Protection (for T1190) : Web Application Firewalls may be used to limit exposure of applications to prevent exploit traffic from reaching the application.
- M1035 Limit Access to Resource Over Network (for T1190) : Ensure that all publicly exposed services are actually intended to be so, and restrict access to any that should only be available internally.
- M1051 Update Software (for T1190) : Update software regularly by employing patch management for externally exposed applications.
- M1033 Limit Software Installation (for T1059) : Prevent user installation of unrequired command and scripting interpreters.
- M1045 Code Signing (for T1059) : Where possible, only permit execution of signed scripts.
Detection Generic guidance
- Initial Access: Alert on unusual requests to the affected service (odd paths, oversized payloads, exploit strings) in WAF, reverse-proxy and application logs.
- Execution: Watch for the service process spawning shells or script interpreters (cmd.exe, powershell, sh, bash, python) via EDR process-tree rules.
Response checklist Generic guidance
- Inventory: find every instance of the affected product and version (include internet-facing and forgotten ones).
- Patch or mitigate per the vendor advisory; if you cannot patch, remove internet exposure or apply the vendor workaround.
- Assume compromise if the system was exposed before patching: hunt for the indicators in the advisory and review logs back to the disclosure date.
- Rotate credentials and secrets stored on or used by the affected system if compromise cannot be ruled out.