What is the CVSS score of CVE-2025-49136?

CVE-2025-49136 has a contested CVSS base score of 9.0 from a third party (e.g. CISA-ADP), while the vendor rates it Critical. vuln.today uses the vendor rating as authoritative.

Is there a public PoC exploit available for CVE-2025-49136?

Yes, a public proof-of-concept exploit is available for CVE-2025-49136. Prioritise patching immediately. EPSS: 41.3%.

How to fix or mitigate CVE-2025-49136?

Within 24 hours: Identify all listmonk instances in your environment and determine if multi-user access is enabled; restrict template and campaign permissions to trusted administrators only as an interim measure. Within 7 days: Upgrade all affected listmonk instances to version 5.0.2 or later. Within 30 days: Conduct a security audit to identify any unauthorized environment variable access in logs; rotate all sensitive credentials (database passwords, API keys) that may have been exposed.

Listmonk CVE-2025-49136

Q: Which versions of Listmonk are affected by CVE-2025-49136?

A critical vulnerability in listmonk (versions 4.0.0 to 5.0.2) allows non-administrative users with campaign or template permissions to extract sensitive environment variables from the hosting…. A patch is available.

EUVD-2025-17462 CRITICAL

Improper Neutralization of Special Elements Used in a Template Engine (CWE-1336)

2025-06-09 security-advisories@github.com

GHSA-jc7g-x28f-3v3h

Privilege Escalation Information Disclosure Listmonk Suse Nadh

Critical

Disputed · 9.0 NVD

View

Vulnerability Assessment

Weakness	CWE CWE-1336 OWASP Top 10:2025 A06:2021 - Vulnerable and Outdated Components ASVS 5.0 V1 - Encoding and Sanitization Template injection prevention
Impact	CVSS 9.0. EPSS 41.3% (elevated exploitation probability). Public PoC/exploit available. Vendor patch available.
Exploit ScenarioDerived	An attacker could exploit this vulnerability in version 4.0.0 and to compromise the security of affected deployments, potentially impacting confidentiality, integrity, or availability.

Act Now Prioritize within 24-48h. Why: CRITICAL severity + public POC available.

Patch available 41.3% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Mar 14, 2026

A security vulnerability in version 4.0.0 and (CVSS 9.0) that allows capturing of env variables. Risk factors: EPSS 41% exploitation probability, public PoC available. Vendor patch is available.

Earlier versions of this analysis (1)

v1 Mar 14, 2026 - 19:21 CVSS 9.0

RemediationAI

Apply the vendor-supplied patch immediately.

Affected VersionsENISA

listmonk 4.0.0, < 5.0.2

Affected Packages

go github.com/knadh/listmonk fix: 5.0.2

euvd listmonk_4_0_0 fix: 5.0.2

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 2 packages in go, euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Technical ContextAI · show details

Vulnerability type not specified by vendor. CVSS 9.0 indicates critical severity with likely remote exploitation vector. Affects version 4.0.0 and.

Know when Listmonk gets its next vulnerability

Watch products and get an email when something new is published
Check this CVE against your own stack and servers
Exploit and PoC references, threat intelligence from 22 sources

Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Sources disagree (Low–Critical)

GitHub Advisory PRIMARY 9.0 CRITICAL

AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H

SUSE 3.1 LOW

AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H

vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.

CVSS VectorGitHub Advisory

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

Required

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Patch released

Mar 14, 2026 - 19:21 nvd

Patch available

PoC Detected

Jul 11, 2025 - 17:23 vuln.today

Public exploit code

CVE Published

Jun 09, 2025 - 17:15 nvd

CRITICAL 9.0

DescriptionGitHub Advisory

listmonk is a standalone, self-hosted, newsletter and mailing list manager. Starting in version 4.0.0 and prior to version 5.0.2, the env and expandenv template functions which is enabled by default in Sprig enables capturing of env variables on host. While this may not be a problem on single-user (super admin) installations, on multi-user installations, this allows non-super-admin users with campaign or template permissions to use the {{ env }} template expression to capture sensitive environment variables. Users should upgrade to v5.0.2 to mitigate the issue.

Executive ViewAI

Why It Matters

A critical vulnerability in listmonk (versions 4.0.0 to 5.0.2) allows non-administrative users with campaign or template permissions to extract sensitive environment variables from the hosting server, potentially exposing database credentials, API keys, and other secrets. Organizations running multi-user listmonk installations are at immediate risk of privilege escalation and data compromise.

Business Impact: Severe

Compensating Controls

Apply vendor patch. If immediate patching is not possible: disable template and campaign creation permissions for all non-super-admin users; implement network-level access controls to restrict which users can access listmonk; monitor and log all template/campaign operations for suspicious env variable references; consider temporarily disabling the Sprig template engine if operationally feasible.

Threat Intelligence Overview

Threat Score

4.5/10

Composite threat intelligence

EPSS Score

41.3%

Top 3% exploitable

Exploit

POC

Public exploit code exists

Data Quality

6 sources

Confidence: High

EUVD

NVD

CVE.org

EPSS POC (1) Vendor

GitHub

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue

Severity CRITICAL

CISA KEV No

Public POC Yes

EPSS 41.3%

Patch available Yes

Active threat Yes

Deciding rule

CRITICAL severity + public POC available

What every action level means

Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.

Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.

This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.

This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.

Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision· derived

Out-of-Cycle

Exploitation· derived

Poc

System Exposure· derived

Open

Automatable· derived

Human Impact

Very High

Priority Score

106

Low Medium High Critical

KEV: 0

EPSS: +41

CVSS: +45

PoC: +20

Weaponized: 0

Threat intel: 0

Gov advisory: 0

Attack Technique

Privilege Escalation HIGH

Privilege escalation occurs when an attacker leverages flaws in access control mechanisms to gain permissions beyond what they were originally granted.

Information Disclosure MEDIUM

Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.

More in Listmonk

View all

CVE-2025-58430 HIGH This Week POC

8.6 Sep 09

listmonk is a standalone, self-hosted, newsletter and mailing list manager. Rated high severity (CVSS 8.6), this vulnera

CVE-2026-21483 MEDIUM This Month POC

5.4 Jan 02

Stored XSS in Listmonk before version 6.0.0 allows authenticated users with campaign management permissions to inject ma

CVE-2025-46011 MEDIUM This Month

6.5 Jun 04

Listmonk v4.1.0 (fixed in v5.0.0) is vulnerable to SQL Injection in the QuerySubscribers function which allows attackers

CVE-2026-62361 MEDIUM This Month

5.5 Jul 15

SQL injection in listmonk's subscriber export endpoint prior to version 6.2.0 allows a highly-privileged authenticated u

CVE-2026-34584 MEDIUM This Month

5.4 Apr 02

Listmonk versions 4.1.0 through 6.0.x contain authorization bypass vulnerabilities in list permission checks that allow

Same weakness CWE-1336 – Improper Neutralization of Special Elements Used in a Template Engine

View all

CVE-2024-23692 CRITICAL POC

9.8

CVE-2025-47916 CRITICAL POC

10.0

CVE-2025-49619 HIGH POC

8.5

CVE-2024-6386 CRITICAL POC

9.9

CVE-2026-75650 CRITICAL POC

10.0

CVE-2025-69516 HIGH POC

8.8

CVE-2025-53833 CRITICAL POC

10.0

CVE-2026-39980 CRITICAL POC

9.1

Same technique Privilege Escalation

View all

CVE-2024-0012 CRITICAL POC

9.3

CVE-2025-47812 CRITICAL POC

10.0

CVE-2013-0422 CRITICAL POC

9.8

CVE-2013-0632 CRITICAL POC

9.8

CVE-2024-9474 MEDIUM POC

6.9

CVE-2017-5689 CRITICAL POC

9.8

CVE-2021-20021 CRITICAL POC

9.8

CVE-2017-12635 CRITICAL POC

9.8

Vendor StatusVendor

SUSE

Severity: Low

Product	Status
Container suse/sl-micro/6.0/baremetal-os-container:latest	Affected
SUSE Linux Enterprise Server 16.0	Fixed
openSUSE Tumbleweed	Fixed
SUSE Linux Enterprise Server 16.1	Fixed
SUSE Linux Enterprise Server for SAP applications 16.1	Fixed

References

Advisories & patches

PATCH https://github.com/knadh/listmonk/commit/d27d2c32cf3af2d0b24e29ea5a686ba149b49b3e ADVISORY https://github.com/knadh/listmonk ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2025-49136 REF https://github.com/knadh/listmonk/releases/tag/v5.0.2

Search Externally

GitHub PoC

Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC

Back