{"uuid": "b43eb4f7-a5d3-40f8-8ba9-b270f90cbcb9", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-49136", "type": "seen", "source": "https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/gather/listmonk_env_disclosure.rb", "content": "{\"actions\": [], \"aliases\": [], \"arch\": \"\", \"author\": [\"Tarek Nakkouch\"], \"autofilter_ports\": [80, 8080, 443, 8000, 8888, 8880, 8008, 3000, 8443], \"autofilter_services\": [\"http\", \"https\"], \"check\": true, \"default_credential\": false, \"description\": \"This module exploits insecure Sprig template functions in Listmonk\\n          versions prior to v5.0.2. The env and expandenv functions are enabled\\n          by default, allowing authenticated users with campaign permissions to\\n          extract sensitive environment variables via campaign preview.\", \"disclosure_date\": \"2025-06-08\", \"fullname\": \"auxiliary/gather/listmonk_env_disclosure\", \"is_install_path\": true, \"mod_time\": \"2026-02-09 15:17:23 +0000\", \"name\": \"Listmonk Insecure Sprig Template Functions Environment Disclosure\", \"needs_cleanup\": false, \"notes\": {\"Reliability\": [], \"SideEffects\": [\"ioc-in-logs\"], \"Stability\": [\"crash-safe\"]}, \"path\": \"/modules/auxiliary/gather/listmonk_env_disclosure.rb\", \"platform\": \"\", \"post_auth\": true, \"rank\": 300, \"ref_name\": \"gather/listmonk_env_disclosure\", \"references\": [\"CVE-2025-49136\", \"GHSA-jc7g-x28f-3v3h\"], \"rport\": 9000, \"session_types\": false, \"targets\": null, \"type\": \"auxiliary\"}", "creation_timestamp": "2026-09-08T06:47:17.028901Z"}