CVE-2024-58302CWE-98

FoF Pretty Mail 1.1.2 Local File Inclusion via Email Template Settings

Medium · published December 11, 2025

CVSS v4.0
6.9
EPSS
0%
Percentile
25.7
In the wild
Unconfirmed
What it is

FoF Pretty Mail 1.1.2 contains a local file inclusion vulnerability that allows administrative users to include arbitrary server files in email templates. Attackers can exploit the template settings by inserting file inclusion payloads to read sensitive system files like /etc/passwd during email generation.

The record
Technical detail
CVSS v4.0
6.9 · MEDIUM
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
EPSS
0.00336 · 25.7th percentile
Weakness
CWE-98 · Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')
Published
2025-12-11T21:40Z
EPSS history
Timeline
  • 11 DEC 21:40Z
    FoF Pretty Mail 1.1.2 Local File Inclusion via Email Template Settings
    cvelistv5