GHSA-947q-2xw3-gx9c

FoF Pretty Mail has a server-side template injection vulnerability

Source: GitHub Advisory Database (reviewed) High CVE-2024-58303

Packages

Ecosystem	Package	Affected	Fixed in
Packagist	fof/pretty-mail	<= 1.1.2	no fix listed

Details

As written in the advisory (Markdown source, shown as plain text).

FoF Pretty Mail 1.1.2 contains a server-side template injection vulnerability that allows administrative users to inject malicious code into email templates. Attackers can execute system commands by inserting crafted template expressions that trigger arbitrary code execution during email generation.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2024-58303 advisory
https://flarum.org web
https://github.com/FriendsOfFlarum/pretty-mail package
https://www.exploit-db.com/exploits/51948 web
https://www.vulncheck.com/advisories/fof-pretty-mail-server-side-template-injection-via-email-template-settings web