What is the CVSS score of CVE-2025-49136?

CVE-2025-49136 has a contested CVSS base score of 9.0 from a third party (e.g. CISA-ADP), while the vendor rates it Critical. vuln.today uses the vendor rating as authoritative.

Which versions of Listmonk are affected by CVE-2025-49136?

A critical vulnerability in listmonk (versions 4.0.0 to 5.0.2) allows non-administrative users with campaign or template permissions to extract sensitive environment variables from the hosting…. A patch is available.

Is there a public PoC exploit available for CVE-2025-49136?

Yes, a public proof-of-concept exploit is available for CVE-2025-49136. Prioritise patching immediately. EPSS: 41.3%.

How to fix or mitigate CVE-2025-49136?

Within 24 hours: Identify all listmonk instances in your environment and determine if multi-user access is enabled; restrict template and campaign permissions to trusted administrators only as an interim measure. Within 7 days: Upgrade all affected listmonk instances to version 5.0.2 or later. Within 30 days: Conduct a security audit to identify any unauthorized environment variable access in logs; rotate all sensitive credentials (database passwords, API keys) that may have been exposed.

Listmonk CVE-2025-49136

EUVD-2025-17462 CRITICAL

Improper Neutralization of Special Elements Used in a Template Engine (CWE-1336)

2025-06-09 security-advisories@github.com

GHSA-jc7g-x28f-3v3h

Information Disclosure Privilege Escalation Listmonk Suse

Critical

Disputed · 9.0 NVD

Severity by source

Sources disagree (Low–Critical)

GitHub Advisory PRIMARY

9.0 CRITICAL

AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H

SUSE

3.1 LOW

AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H

vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.

CVSS VectorGitHub Advisory

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

Required

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

EUVD ID Assigned

Mar 14, 2026 - 19:21 euvd

EUVD-2025-17462

Analysis Generated

Mar 14, 2026 - 19:21 vuln.today

Patch released

Mar 14, 2026 - 19:21 nvd

Patch available

PoC Detected

Jul 11, 2025 - 17:23 vuln.today

Public exploit code

CVE Published

Jun 09, 2025 - 17:15 nvd

CRITICAL 9.0

DescriptionGitHub Advisory

listmonk is a standalone, self-hosted, newsletter and mailing list manager. Starting in version 4.0.0 and prior to version 5.0.2, the env and expandenv template functions which is enabled by default in Sprig enables capturing of env variables on host. While this may not be a problem on single-user (super admin) installations, on multi-user installations, this allows non-super-admin users with campaign or template permissions to use the {{ env }} template expression to capture sensitive environment variables. Users should upgrade to v5.0.2 to mitigate the issue.

AnalysisAI

A security vulnerability in version 4.0.0 and (CVSS 9.0) that allows capturing of env variables. Risk factors: EPSS 41% exploitation probability, public PoC available. Vendor patch is available.

Technical ContextAI

Vulnerability type not specified by vendor. CVSS 9.0 indicates critical severity with likely remote exploitation vector. Affects version 4.0.0 and.

RemediationAI

Apply the vendor-supplied patch immediately.

More in Listmonk

View all

CVE-2025-58430 HIGH This Week POC

8.6 Sep 09

listmonk is a standalone, self-hosted, newsletter and mailing list manager. Rated high severity (CVSS 8.6), this vulnera

CVE-2026-21483 MEDIUM This Month POC

5.4 Jan 02

Stored XSS in Listmonk before version 6.0.0 allows authenticated users with campaign management permissions to inject ma

CVE-2025-46011 MEDIUM This Month

6.5 Jun 04

Listmonk v4.1.0 (fixed in v5.0.0) is vulnerable to SQL Injection in the QuerySubscribers function which allows attackers

CVE-2026-62361 MEDIUM This Month

5.5 Jul 15

SQL injection in listmonk's subscriber export endpoint prior to version 6.2.0 allows a highly-privileged authenticated u

CVE-2026-34584 MEDIUM This Month

5.4 Apr 02

Listmonk versions 4.1.0 through 6.0.x contain authorization bypass vulnerabilities in list permission checks that allow

Same weakness CWE-1336 – Improper Neutralization of Special Elements Used in a Template Engine

View all

CVE-2025-47916 CRITICAL POC

10.0

CVE-2025-49619 HIGH POC

8.5

CVE-2024-6386 CRITICAL POC

9.9

CVE-2025-69516 HIGH POC

8.8

CVE-2025-53833 CRITICAL POC

10.0

CVE-2024-23692 CRITICAL POC

9.8

CVE-2025-23211 CRITICAL POC

9.9

CVE-2024-32651 CRITICAL POC

10.0

Same technique Information Disclosure

View all

CVE-2013-2251 CRITICAL POC

9.8

CVE-2017-5638 CRITICAL POC

9.8

CVE-2025-24813 CRITICAL POC

9.8

CVE-2015-1701 HIGH POC

7.8

CVE-2017-0147 HIGH POC

7.5

CVE-2014-6324 HIGH POC

8.8

CVE-2023-7028 CRITICAL POC

10.0

CVE-2017-0213 HIGH POC

7.3

Vendor StatusVendor

SUSE

Severity: Low

Product	Status
Container suse/sl-micro/6.0/baremetal-os-container:latest	Affected
SUSE Linux Enterprise Server 16.0	Fixed
openSUSE Tumbleweed	Fixed
SUSE Linux Enterprise Server 16.1	Fixed
SUSE Linux Enterprise Server for SAP applications 16.1	Fixed

CVE-2025-49136 vulnerability details – vuln.today

Back

Listmonk CVE-2025-49136

Severity by source

CVSS VectorGitHub Advisory

Lifecycle Timeline

DescriptionGitHub Advisory

AnalysisAI

Technical ContextAI

RemediationAI

More in Listmonk

Same weakness CWE-1336 – Improper Neutralization of Special Elements Used in a Template Engine

Same technique Information Disclosure

Vendor StatusVendor

SUSE

Share

External POC / Exploit Code