p PatchFirst

CVE-2024-58303

CVE-2024-58303 · FoF Pretty Mail 1.1.2 Server Side Template Injection via Email Template Settings

This page contains facts from public vulnerability sources. Check the original advisory before updating.

FoF Pretty Mail 1.1.2 contains a server-side template injection vulnerability that allows administrative users to inject malicious code into email templates. Attackers can execute system commands by inserting crafted template expressions that trigger arbitrary code execution during email generation.

CVSS 8.6 · High · EPSS 0.5%

Published
Updated

Stack: php

Affected products and versions

  • friendsofflarum pretty mail

    Versions
    • 1.1.2: Affected

    No fix published

  • fof/pretty-mail Packagist

    Versions
    • 0.1.0
    • 0.1.0-beta.1
    • 0.1.0-beta.2
    • 0.1.0-beta.3
    • 0.1.1
    • 0.1.2
    • 0.1.3
    • 0.1.4
    • 0.1.5
    • 0.1.6
    • 0.1.7
    • 0.2.0
    • 0.2.1
    • 0.3.0
    • 0.4.0
    • 1.0.0
    • 1.0.1
    • 1.1.0
    • 1.1.1
    • 1.1.2
    Affected ranges
    • ECOSYSTEM: ≤ 1.1.2

    No fix published

Original sources

Check your server →