Github.Com Knadh Listmonk vulnerabilities

CVE-2025-49136 [CRITICAL] CWE-1336 listmonk's Sprig template Injection vulnerability leads to reading of Environment Variable for low privilege user listmonk's Sprig template Injection vulnerability leads to reading of Environment Variable for low privilege user ### Summary The `env` and `expandenv` template functions which is enabled by default in [Sprig](https://masterminds.github.io/sprig/) enables capturing of env variables on the host. While this may not be a problem on single-user (super

CVE-2026-34828 [HIGH] CWE-613 listmonk's active sessions remain valid after password reset and password change listmonk's active sessions remain valid after password reset and password change ### Summary A session management vulnerability allows previously issued authenticated sessions to remain valid after sensitive account security changes, specifically password reset and password change. As a result, an attacker who has already obtained a valid session cookie can retain access to the account

CVE-2026-21483 [MEDIUM] CWE-79 listmonk Vulnerable to Stored XSS Leading to Admin Account Takeover listmonk Vulnerable to Stored XSS Leading to Admin Account Takeover ## Security Advisory: Stored XSS Leading to Admin Account Takeover **Affected Versions:** ≤ 5.1.0 **Vulnerability Type:** CWE-79: Stored Cross-Site Scripting --- ## Summary A lower-privileged user with campaign management permissions can inject malicious JavaScript into campaigns or templates. When a higher-privileged user (Su

CVE-2025-58430 [HIGH] CWE-352 listmonk: CSRF to XSS Chain can Lead to Admin Account Takeover listmonk: CSRF to XSS Chain can Lead to Admin Account Takeover ### Summary Cross-Site Request Forgery (CSRF) is an attack that forces an end user to execute unwanted actions on a web application in which they’re currently authenticated. With a little help of social engineering (such as sending a link via email or chat), an attacker may trick the users of a web application into executing actions of the