CVE-2024-58303
FoF Pretty Mail 1.1.2 Server Side Template Injection via Email Template Settings
- State
- Published
- Severity
- 8.6 High
- Published
- Dec 11, 2025
- Updated
- Oct 8, 2026
- Reserved
- Dec 11, 2025
Description
FoF Pretty Mail 1.1.2 contains a server-side template injection vulnerability that allows administrative users to inject malicious code into email templates. Attackers can execute system commands by inserting crafted template expressions that trigger arbitrary code execution during email generation.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 8.6 High | CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N | VulnCheck |
Weaknesses
- CWE-1336 Improper Neutralization of Special Elements Used in a Template Engine (SSTI)
Affected Products
| Product | Versions |
|---|---|
FriendsofFlarum Pretty MailFlarum |
|
References
- ExploitDB-51948exploit
- Flarum Homepageproduct
- Pretty Mail GitHub Repositoryproduct
- VulnCheck Advisory: FoF Pretty Mail 1.1.2 Server Side Template Injection via Email Template Settingsthird-party-advisory
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.