listmonk is a standalone, self-hosted, newsletter and mailing list manager. Starting in version 4.0.0 and…
Historical advisory recorded 25 Oct 2026 02:25:01 UTC. Read the latest advisory.
nvd · CVE-2025-49136
Publishedlistmonk is a standalone, self-hosted, newsletter and mailing list manager. Starting in version 4.0.0 and prior to version 5.0.2, the `env` and `expandenv` template functions which is enabled by default in Sprig enables capturing of env variables on host. While this may not be a problem on single-user (super admin) installations, on multi-user installations, this allows non-super-admin users with campaign or template permissions to use the `{{ env }}` template expression to capture sensitive environment variables. Users should upgrade to v5.0.2 to mitigate the issue.
Read the publisher's advisoryAffected versions, risk and source history
nvd · CVE-2025-49136
PublishedNVD analysis and CPE criteria are source context, not proof that a package or your environment is affected. Complete affected data, logical configurations and SSVC are retained in the original JSON.
Source analysis status: Analyzed
Weakness classifications: CWE-1336 · NVD-CWE-noinfo
Original publisher date fields
published: 2025-06-09T17:15:29.917
lastModified: 2026-06-17T09:30:48.450
1 source CPE criteria · context only
- cpe:2.3:a:nadh:listmonk:*:*:*:*:*:*:*:*
The original JSON retains the logical configuration operators, exclusions and version bounds.
No normalized affected-package data is projected for this source revision. The original publisher record may contain additional product and version evidence; this does not establish that a package is unaffected.
Original source record · Cite this exact observation · Complete original publisher JSON