Read the docs
TI-2024-38399 Aliases CVE-2024-58302GHSA-54q9-c4j4-jf82

FoF Pretty Mail 1.1.2 Local File Inclusion via Email Template Settings

Priority LOW 30CWE-98Published · Updated

Key facts

Attack vector
Network
Privileges required
High
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
Code execution
Confidentiality · integrity · availability
High · None · None
Fix status
No fix listed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-98.

Summary

FoF Pretty Mail 1.1.2 contains a local file inclusion vulnerability that allows administrative users to include arbitrary server files in email templates. Attackers can exploit the template settings by inserting file inclusion payloads to read sensitive system files like /etc/passwd during email generation.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00336 27th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by the CNA
Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
flarumFriendsofFlarum Pretty Mail1.1.2—No fix listedCNA
  • FriendsofFlarum Pretty Mail Vendorflarum Affected 1.1.2 Fixed in — No fix listed CNA

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2024-58302
  2. 2026-10-03 Alias added: GHSA-54q9-c4j4-jf82

References

Exploit 1

Other 2

  • TI-2021-12339 XSS vulnerability with translator CVSS 3.1CRITICAL 10.0
  • TI-2023-08736 Post mentions can be used to read any post on the forum without access control CVSS 3.1HIGH 7.7
  • TI-2025-20573 Flarum Vulnerable to Session Hijacking via Authoritative Subdomain Cookie Overwrite CVSS 3.1MEDIUM 6.8
  • TI-2026-30290 Flarum: Path traversal in LESS parser via theme color settings (incomplete fix for CVE-2023-27577) CVSS 3.1MEDIUM 4.9
  • TI-2026-23739 flarum/nickname: Display name injection in notification emails (autolink & markdown) CVSS 3.1MEDIUM 4.6
  • TI-2026-28792 Flarum < 1.8.16 Password Reset Token Expiry Bypass via POST /reset CVSS 4.0CRITICAL 9.2
See all 19 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences