{"vulnerability": "CVE-2025-49136", "sightings": [{"uuid": "12b23322-1de4-460b-ad2c-cbdf3ab07294", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-49136", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3lr762ttnys2e", "content": "", "creation_timestamp": "2025-06-09T19:58:41.177022Z"}, {"uuid": "63d01736-5cd5-403b-9dd8-f013d9598d1b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-49136", "type": "seen", "source": "MISP/a9d21043-f825-4bac-8d2b-56fb9e8343e7", "content": "", "creation_timestamp": "2025-10-23T21:13:04.000000Z"}, {"uuid": "4f11a5ed-0073-4cbb-beef-4b1ef24a11a2", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-49136", "type": "seen", "source": "https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/gather/listmonk_env_disclosure.rb", "content": "", "creation_timestamp": "2025-10-08T21:09:17.000000Z"}, {"uuid": "75417ed2-a523-4b52-9a97-3ee08687e8d6", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-49136", "type": "seen", "source": "https://gist.github.com/alon710/128173bdf7a72d5dd0cfdf8f4e2ec93f", "content": "", "creation_timestamp": "2026-01-24T21:30:40.000000Z"}, {"uuid": "2fcd6acc-5dee-41ed-9237-fca882cb8e74", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-49136", "type": "seen", "source": "https://gist.github.com/alon710/2aeb9181d822da66f0341f802419d7a7", "content": "", "creation_timestamp": "2026-01-24T21:30:38.000000Z"}, {"uuid": "58a656c5-4bfb-478a-b9ea-42323aee0cf2", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-49136", "type": "seen", "source": "https://gist.github.com/alon710/75bd805fd5fae660ad9e3111584de4d0", "content": "", "creation_timestamp": "2026-01-24T22:42:40.000000Z"}, {"uuid": "dfc013be-9d10-45be-8aca-f59fddaa30fb", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-49136", "type": "published-proof-of-concept", "source": "https://t.me/DarkWebInformer_CVEAlerts/17703", "content": "\ud83d\udd17 DarkWebInformer.com - Cyber Threat Intelligence\n\ud83d\udccc CVE ID: CVE-2025-49136\n\ud83d\udd25 CVSS Score: 9.1 (cvssV3_1, Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H)\n\ud83d\udd39 Description: listmonk is a standalone, self-hosted, newsletter and mailing list manager. Starting in version 4.0.0 and prior to version 5.0.2, the `env` and `expandenv` template functions which is enabled by default in Sprig enables capturing of env variables on host. While this may not be a problem on single-user (super admin) installations, on multi-user installations, this allows non-super-admin users with campaign or template permissions to use the `{{ env }}` template expression to capture sensitive environment variables. Users should upgrade to v5.0.2 to mitigate the issue.\n\ud83d\udccf Published: 2025-06-09T16:21:48.266Z\n\ud83d\udccf Modified: 2025-06-09T16:21:48.266Z\n\ud83d\udd17 References:\n1. https://github.com/knadh/listmonk/security/advisories/GHSA-jc7g-x28f-3v3h\n2. https://github.com/knadh/listmonk/commit/d27d2c32cf3af2d0b24e29ea5a686ba149b49b3e\n3. https://github.com/knadh/listmonk/releases/tag/v5.0.2", "creation_timestamp": "2025-06-09T16:56:04.000000Z"}, {"uuid": "b43eb4f7-a5d3-40f8-8ba9-b270f90cbcb9", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-49136", "type": "seen", "source": "https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/gather/listmonk_env_disclosure.rb", "content": "{\"actions\": [], \"aliases\": [], \"arch\": \"\", \"author\": [\"Tarek Nakkouch\"], \"autofilter_ports\": [80, 8080, 443, 8000, 8888, 8880, 8008, 3000, 8443], \"autofilter_services\": [\"http\", \"https\"], \"check\": true, \"default_credential\": false, \"description\": \"This module exploits insecure Sprig template functions in Listmonk\\n          versions prior to v5.0.2. The env and expandenv functions are enabled\\n          by default, allowing authenticated users with campaign permissions to\\n          extract sensitive environment variables via campaign preview.\", \"disclosure_date\": \"2025-06-08\", \"fullname\": \"auxiliary/gather/listmonk_env_disclosure\", \"is_install_path\": true, \"mod_time\": \"2026-02-09 15:17:23 +0000\", \"name\": \"Listmonk Insecure Sprig Template Functions Environment Disclosure\", \"needs_cleanup\": false, \"notes\": {\"Reliability\": [], \"SideEffects\": [\"ioc-in-logs\"], \"Stability\": [\"crash-safe\"]}, \"path\": \"/modules/auxiliary/gather/listmonk_env_disclosure.rb\", \"platform\": \"\", \"post_auth\": true, \"rank\": 300, \"ref_name\": \"gather/listmonk_env_disclosure\", \"references\": [\"CVE-2025-49136\", \"GHSA-jc7g-x28f-3v3h\"], \"rport\": 9000, \"session_types\": false, \"targets\": null, \"type\": \"auxiliary\"}", "creation_timestamp": "2026-09-08T06:47:17.028901Z"}]}