CVE-2024-58302

6.9 mediumEPSS 0.3%

Medium (6.9). EPSS 0.3% chance of exploitation in the next 30 days.

FoF Pretty Mail 1.1.2 contains a local file inclusion vulnerability that allows administrative users to include arbitrary server files in email templates. Attackers can exploit the template settings by inserting file inclusion payloads to read sensitive system files like /etc/passwd during email generation.

Severity

CVSS 4.0

6.9 medium

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

EPSS: 0.3% chance of exploitation in the next 30 days; higher than 26% of CVEs (scores of 2026-10-31)
CWE: CWE-98
Published: 2025-12-11
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

References

https://flarum.org/
https://github.com/FriendsOfFlarum/pretty-mail
https://www.exploit-db.com/exploits/51947
https://www.vulncheck.com/advisories/fof-pretty-mail-local-file-inclusion-via-email-template-settings

Check your stack JSON