Read the docs
TI-2026-44510 Aliases CVE-2026-62361GHSA-xgjr-7j9q-2h4r

SQL injection in knadh listmonk

Priority MEDIUM 58CWE-89Published · Updated

Key facts

Attack vector
Network
Privileges required
High
User interaction
None
Attack complexity
Low
Impact type
SQL injection
Confidentiality · integrity · availability
High · Low · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-89.

Summary

listmonk is a standalone, self-hosted, newsletter and mailing list manager. Prior to 6.2.0, listmonk’s GET /api/subscribers/export endpoint injects the user-controlled query parameter into QuerySubscribersForExport in internal/core/subscribers.go without calling validateQueryTables, unlike GET /api/subscribers, allowing an authenticated user with subscribers:sql_query and subscribers:get_all to read arbitrary database tables such as users and settings and execute data-modifying PostgreSQL CTEs. This issue is fixed in version 6.2.0.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00297 22nd percentileScored 2026-11-07
Fix Fixed listmonk (knadh): 6.2.0github.com/knadh/listmonk (Go): 1.1.1-0.20260619102436-c0a6525009a6

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
knadhlistmonkbefore 6.2.06.2.0Patch availableCNA
—github.com/knadh/listmonk (Go)before 1.1.1-0.20260619102436-c0a6525009a61.1.1-0.20260619102436-c0a6525009a6Patch availableGHSA-xgjr-7j9q-2h4r
  • listmonk Vendorknadh Affected before 6.2.0 Fixed in 6.2.0 Patch available CNA
  • github.com/knadh/listmonk (Go) Vendor— Affected before 1.1.1-0.20260619102436-c0a6525009a6 Fixed in 1.1.1-0.20260619102436-c0a6525009a6 Patch available GHSA-xgjr-7j9q-2h4r

CPE names Threatist (inferred) · 1

Inferred from how NVD named this product before; not given by a source.

CPEVersionsRoleVendor
cpe:2.3:a:nadh:listmonk:*:*:*:*:*:*:*:*——knadh
  • cpe:2.3:a:nadh:listmonk:*:*:*:*:*:*:*:* Versions — — ·knadh

Remediation

  • Fix · CNA listmonk (knadh) Fixed in 6.2.0
  • Fix · GHSA-xgjr-7j9q-2h4r github.com/knadh/listmonk (Go) Fixed in 1.1.1-0.20260619102436-c0a6525009a6 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-62361
  2. 2026-11-06 Alias added: GHSA-xgjr-7j9q-2h4r
  3. 2026-11-06 Fix available: Go/github.com/knadh/[email protected] · GHSA-xgjr-7j9q-2h4r
  4. 2026-11-06 CVSS score added · GHSA-xgjr-7j9q-2h4r
  5. 2026-11-06 Weakness changed · GHSA-xgjr-7j9q-2h4r
  6. 2026-11-06 5 new references · GHSA-xgjr-7j9q-2h4r

References

Advisory 1

Other 4

  • TI-2025-31216 listmonk's Sprig template Injection vulnerability leads to reading of Environment Variable for low privilege user CVSS 3.1CRITICAL 9.1
  • TI-2025-36190 listmonk Vulnerable to CSRF to XSS Chain That Can Lead to Admin Account Takeover CVSS 4.0HIGH 8.6
  • TI-2026-27072 listmonk: Active sessions remain valid after password reset and password change CVSS 3.1HIGH 7.1
  • TI-2026-17337 listmonk Vulnerable to Stored XSS Leading to Admin Account Takeover CVSS 4.0MEDIUM 5.4
  • TI-2025-28914 Listmonk v4.1.0 (fixed in v5.0.0) is vulnerable to SQL Injection in the QuerySubscribers… CVSS 3.1MEDIUM 6.5
  • TI-2026-26831 listmonk: Broken Access Control in CSV Import (Unauthorized List Assignment) CVSS 3.1MEDIUM 5.4

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences