CVE-2025-49136
Description
listmonk is a standalone, self-hosted, newsletter and mailing list manager. Starting in version 4.0.0 and prior to version 5.0.2, the `env` and `expandenv` template functions which is enabled by default in Sprig enables capturing of env variables on host. While this may not be a problem on single-user (super admin) installations, on multi-user installations, this allows non-super-admin users with campaign or template permissions to use the `{{ env }}` template expression to capture sensitive environment variables. Users should upgrade to v5.0.2 to mitigate the issue.
How to fix
- nadh listmonk5.0.2 or later
- github.com/knadh/listmonk5.0.2 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| nadh listmonk | 4.0.0 ≤ v < 5.0.2 | 5.0.2 |
| github.com/knadh/listmonkGo | 4.0.0 ≤ v < 5.0.2, No range specified | 5.0.2 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.