CVE-2024-58303 | THREATINT

Description

FoF Pretty Mail 1.1.2 contains a server-side template injection vulnerability that allows administrative users to inject malicious code into email templates. Attackers can execute system commands by inserting crafted template expressions that trigger arbitrary code execution during email generation.

PUBLISHED Reserved 2025-12-11 | Published 2025-12-11 | Updated 2025-12-11 | Assigner VulnCheck

HIGH: 8.6CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Problem types

CWE-1336: Improper Neutralization of Special Elements Used in a Template Engine (SSTI)

Product status

Default status

unaffected

1.1.2

affected

Credits

Chokri Hammedi, <chokri.hammedi@unknown> finder

References

www.exploit-db.com/exploits/51948 (ExploitDB-51948) exploit

flarum.org/ (Flarum Homepage) product

github.com/FriendsOfFlarum/pretty-mail (Pretty Mail GitHub Repository) product

www.vulncheck.com/...e-injection-via-email-template-settings (VulnCheck Advisory: FoF Pretty Mail 1.1.2 Server Side Template Injection via Email Template Settings) third-party-advisory

cve.org (CVE-2024-58303)

nvd.nist.gov (CVE-2024-58303)

Download JSON