GitHub Advisoryadvisory · Packagist

GHSA-947q-2xw3-gx9c FoF Pretty Mail has a server-side template injection vulnerability

HIGH Published 2025-12-12 Modified 2025-12-12 Official page ↗
Aliases
CVE-2024-58303
Ecosystem
Packagist
Packages
fof/pretty-mail
Severity
High
CVSS vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Weaknesses
CWE-1336
Reviewed
2025-12-12

Affected packages

• Packagist fof/pretty-mail: <= 1.1.2 (no fix yet)

Description

FoF Pretty Mail 1.1.2 contains a server-side template injection vulnerability that allows administrative users to inject malicious code into email templates. Attackers can execute system commands by inserting crafted template expressions that trigger arbitrary code execution during email generation.

Related

Alias · CVE (1)

  • CVE-2024-58303 FoF Pretty Mail 1.1.2 contains a server-side template injection vulnerability that allows administrative users to inject malicious code… vulnerability

Weakness · CWE (1)

  • CWE-1336 Improper Neutralization of Special Elements Used in a Template Engine weakness

References