CVE-2024-58303CWE-1336

CVE-2024-58303

published December 12, 2025

CVSS
8.6
EPSS
1%
Percentile
44.5
In the wild
Unconfirmed
What it is

FoF Pretty Mail 1.1.2 contains a server-side template injection vulnerability that allows administrative users to inject malicious code into email templates. Attackers can execute system commands by inserting crafted template expressions that trigger arbitrary code execution during email generation.

The record
Technical detail
CVSS
8.6 · NONE
CVSS v4.0
Not supplied
EPSS
0.00539 · 44.5th percentile
Weakness
CWE-1336 · Improper Neutralization of Special Elements Used in a Template Engine
Published
2025-12-12T03:15Z
References (4)
https://flarum.org/ · [email protected]https://github.com/FriendsOfFlarum/pretty-mail · [email protected]https://www.exploit-db.com/exploits/51948 · [email protected]https://www.vulncheck.com/advisories/fof-pretty-mail-server-side-template-injection-via-email-template-settings · [email protected]
EPSS history
Timeline
  • 11 DEC 21:40Z
    FoF Pretty Mail 1.1.2 Server Side Template Injection via Email Template Settings
    cvelistv5