Vulnerability in Flarum Friendsofflarum Pretty Mail
CVE-2024-58303
FoF Pretty Mail 1.1.2 contains a server-side template injection vulnerability that allows administrative users to inject malicious code into email templates. Attackers can execute system commands by inserting crafted template expressions that trigger arbitrary code execution during email generation.
Published · last modified .
EPSS exploit prediction
EPSS: 0.005 (43.1th percentile), scored .
Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 43rd percentile — 43.1% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.005 · newest: 0.005 · change: -0.000
Affected products
- Flarum Friendsofflarum Pretty Mail — versions 1.1.2
Weakness classification (CWE)
References
- www.exploit-db.com/exploits/51948 (exploit)
- flarum.org/ (product)
- github.com/FriendsOfFlarum/pretty-mail (product)
- www.vulncheck.com/advisories/fof-pretty-mail-server-side-template-injection-via… (third-party-advisory)