CVE-2025-49136

Executive Summary

CVE-2025-49136 is a high-severity information disclosure vulnerability in Listmonk, a self-hosted newsletter and mailing list manager. The flaw resides in the default-enabled Sprig template functions env and expandenv, which allow non-super-admin users with campaign or template permissions to capture sensitive environment variables from the host system. This can lead to exposure of secrets, API keys, database credentials, and other sensitive configuration data. The vulnerability affects versions 4.0.0 through 5.0.1, with a CVSS score of 9.1 (Critical). No public exploit code or proof-of-concept is currently available, and the EPSS score is 0.0%, indicating low exploitation likelihood at this time. The vendor has released a patch in version 5.0.2.

Supply Chain & Package Security

Listmonk is a Go-based application distributed as a standalone binary or via Docker. The vulnerability is introduced through the Sprig template library, which is a Go package used for template functions. The env and expandenv functions are enabled by default in Sprig, and Listmonk does not disable them for non-super-admin users. This is a supply chain risk because the vulnerable functionality comes from a third-party library (Sprig), and the application fails to properly restrict its usage based on user roles. Users should verify the integrity of their Listmonk binary or Docker image and ensure they are running version 5.0.2 or later.

CVSS Breakdown & Threat Level

• CVSS Score: 9.1 (Critical)
• Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: Low (non-super-admin user with campaign/template permissions)
• User Interaction: None
• Scope: Changed (confidentiality impact extends to the host system)
• Confidentiality Impact: High
• Integrity Impact: None
• Availability Impact: None

The threat level is critical due to the potential for complete compromise of host environment variables, which often contain credentials and secrets. The low attack complexity and low privileges required make this a significant risk for multi-user installations.

Deep Dive & Mechanics

The vulnerability is rooted in the Sprig template library, which is integrated into Listmonk for rendering email templates and campaigns. Sprig provides a set of template functions, including env and expandenv, which are designed to read environment variables from the host system. In Listmonk, these functions are enabled by default and are accessible to any user who can create or edit campaigns and templates.

When a non-super-admin user creates a campaign or template, they can inject the {{ env "VARIABLE_NAME" }} or {{ expandenv "TEXT_WITH_VARS" }} syntax into the template content. When the template is rendered (e.g., during preview or sending), Listmonk processes the template using Go's text/template package with Sprig functions. This allows the user to read any environment variable from the host system, including sensitive ones like DATABASE_URL, SECRET_KEY, API_KEYS, etc.

The vulnerability is particularly dangerous in multi-user environments where users have limited permissions but can still create campaigns. A malicious user could exfiltrate environment variables by including them in a campaign that is sent to an external email address they control, or by previewing the campaign and capturing the output.

Vulnerable vs. Patched Code

Vulnerable Code (listmonk < 5.0.2):

In the vulnerable version, the Sprig template functions are loaded without any restrictions. The template rendering code likely uses sprig.FuncMap() to add all Sprig functions to the template context.

// Vulnerable: All Sprig functions are added, including env and expandenv
funcMap := sprig.FuncMap()
tmpl := template.New("").Funcs(funcMap)

Patched Code (listmonk >= 5.0.2):

The patched version removes or disables the env and expandenv functions from the Sprig function map for non-super-admin users. This can be done by creating a custom function map that excludes these functions.

// Patched: Remove env and expandenv functions
funcMap := sprig.FuncMap()
delete(funcMap, "env")
delete(funcMap, "expandenv")
tmpl := template.New("").Funcs(funcMap)

Alternatively, the patch may check the user's role before allowing these functions, or use a whitelist approach for template functions.

Exploitation & Lab Setup

Red Team

Prerequisites:

• Access to a Listmonk instance (version 4.0.0 to 5.0.1) with a non-super-admin user account that has campaign or template creation permissions.
• The ability to create a campaign or template.

Exploitation Steps:

1. Log in to Listmonk as a non-super-admin user.
2. Navigate to the campaign or template creation page.
3. In the template content, insert the following payload to read environment variables:

   {{ env "HOME" }}
   {{ env "DATABASE_URL" }}
   {{ env "SECRET_KEY" }}
   

4. Preview the campaign or send a test email to an attacker-controlled email address.
5. The rendered template will display the values of the environment variables in the preview or email body.

Example Payload for Exfiltration:

To exfiltrate multiple variables, use:

{{ env "HOME" }} | {{ env "DATABASE_URL" }} | {{ env "SECRET_KEY" }}

Note: No public exploit code is available. This is a theoretical exploitation based on the vulnerability description.

Blue Team

Detection and Prevention:

1. Upgrade: Immediately upgrade to listmonk v5.0.2 or later.
2. Monitor Logs: Look for unusual template content containing {{ env or {{ expandenv in application logs.
3. Network Monitoring: Monitor outbound traffic from the Listmonk server for unexpected data exfiltration.
4. User Auditing: Review user permissions and disable campaign/template creation for non-super-admin users if not required.
5. Environment Variable Hygiene: Minimize the number of sensitive environment variables on the host. Use a secrets manager or encrypted storage instead.

Indicators of Compromise (IOCs)

• Log Entries: Template rendering logs containing {{ env or {{ expandenv patterns.
• Network Traffic: Outbound connections from the Listmonk server to external email addresses with unusual content in the email body.
• File System: Temporary files or cached templates containing environment variable values.
• Process: Unusual child processes spawned by the Listmonk binary (e.g., env command execution).

Detection Engineering

YARA Rule

rule CVE_2025_49136_Listmonk_Env_Exploit {
    meta:
        description = "Detects attempts to exploit CVE-2025-49136 in Listmonk by searching for env or expandenv template expressions"
        author = "Valters IT"
        date = "2025-04-10"
        severity = "critical"
    strings:
        $env_func = "{{ env " ascii wide nocase
        $expandenv_func = "{{ expandenv " ascii wide nocase
        $env_var = /{{ env\s+"[A-Za-z_][A-Za-z0-9_]*"\s*}}/ ascii wide
        $expandenv_var = /{{ expandenv\s+"[^"]*"\s*}}/ ascii wide
    condition:
        any of ($env_func, $expandenv_func, $env_var, $expandenv_var)
}

Sigma Rule

title: CVE-2025-49136 Listmonk Environment Variable Exfiltration
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects attempts to exploit CVE-2025-49136 by using env or expandenv template functions in Listmonk campaigns or templates.
author: Valters IT
date: 2025-04-10
logsource:
    category: application
    product: listmonk
detection:
    selection:
        EventID: 1000  # Example: Template rendering event
        TemplateContent|contains:
            - '{{ env '
            - '{{ expandenv '
    condition: selection
falsepositives:
    - Legitimate use by super-admin users (if not patched)
level: critical

Suricata Rule

alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2025-49136 Listmonk Environment Variable Exfiltration"; flow:to_server,established; content:"{{ env "; nocase; content:"{{ expandenv "; nocase; distance:0; within:100; classtype:attempted-recon; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Upgrade: Upgrade to listmonk v5.0.2 immediately. This is the only official patch.
2. Restrict Permissions: If upgrade is not possible, disable campaign and template creation for non-super-admin users.
3. Environment Variable Audit: Review and rotate all secrets stored in environment variables on the affected host.

Long-Term Mitigations:

1. Network Segmentation: Place Listmonk in a segmented network with limited outbound access.
2. Secrets Management: Use a dedicated secrets management solution (e.g., HashiCorp Vault) instead of environment variables.
3. Regular Updates: Subscribe to Listmonk security advisories and apply patches promptly.
4. Code Review: For custom deployments, review the use of third-party libraries and disable dangerous functions.

Workaround (if upgrade is not possible):

• Modify the Listmonk source code to remove env and expandenv from the Sprig function map, then rebuild the binary. This is not recommended for production without thorough testing.

Valters IT
DevSecOps & Cyber Threat Intelligence Expert