CVE-2025-49136

listmonk is a standalone, self-hosted, newsletter and mailing list manager. Starting in version 4.0.0 and prior to version 5.0.2, the `env` and `expandenv` template functions which is enabled by default in Sprig enables capturing of env variables on host. While this may not be a problem on single-user (super admin) installations, on multi-user installations, this allows non-super-admin users with campaign or template permissions to use the `{{ env }}` template expression to capture sensitive environment variables. Users should upgrade to v5.0.2 to mitigate the issue.

• CWE-1336

• https://github.com/knadh/listmonk/commit/d27d2c32cf3af2d0b24e29ea5a686ba149b49b3ePatch
• https://github.com/knadh/listmonk/releases/tag/v5.0.2Release Notes
• https://github.com/knadh/listmonk/security/advisories/GHSA-jc7g-x28f-3v3hExploit, Vendor Advisory
• https://github.com/knadh/listmonk/security/advisories/GHSA-jc7g-x28f-3v3hExploit, Vendor Advisory

Published

Jun 9, 2025

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-49130Laravel Translation Manager is a package to manage Laravel t…6
• CVE-2025-49131FastGPT is an open-source project that provides a platform f…9.9
• CVE-2025-49132Pterodactyl is a free, open-source game server management pa…10
• CVE-2025-49133Libtpms is a library that targets the integration of TPM fun…5.5
• CVE-2025-49134Weblate is a web based localization tool. Prior to version 5…5.3
• CVE-2025-49135CVAT is an open source interactive video and image annotatio…6.5
• CVE-2025-49137HAX CMS PHP allows users to manage their microsite universe …6.1
• CVE-2025-49138HAX CMS PHP allows users to manage their microsite universe …6.5
• CVE-2025-49139HAX CMS PHP allows users to manage their microsite universe …6.5
• CVE-2025-4914A vulnerability was found in PHPGurukul Auto Taxi Stand Mana…9.8
• CVE-2025-49140Pion Interceptor is a framework for building RTP/RTCP commun…7.5
• CVE-2025-49141HAX CMS PHP allows users to manage their microsite universe …8.8