GHSA-947q-2xw3-gx9c (CVE-2024-58303)

Details

FoF Pretty Mail 1.1.2 contains a server-side template injection vulnerability that allows administrative users to inject malicious code into email templates. Attackers can execute system commands by inserting crafted template expressions that trigger arbitrary code execution during email generation.

Affected Packages

fof/pretty-mail

Packagist

References

WEBhttps://flarum.org PACKAGEhttps://github.com/FriendsOfFlarum/pretty-mail ADVISORYhttps://github.com/advisories/GHSA-947q-2xw3-gx9c ADVISORYhttps://nvd.nist.gov/vuln/detail/CVE-2024-58303 WEBhttps://www.exploit-db.com/exploits/51948 WEBhttps://www.vulncheck.com/advisories/fof-pretty-mail-server-side-template-injection-via-email-template-settings

GHSA-947q-2xw3-gx9c

Details

Affected Packages

References

Aliases

CVSS Analysis

Related

Ecosystems

Timeline