CVE-2025-49136

CVE-2025-49136 affects Listmonk before v5.0.2 where Sprig template functions env and expandenv are enabled by default, enabling non-super-admin users (with campaign/template permissions) to read host environment variables via campaign previews. Public reports and the connected Metasploit auxiliar...