PT-2026-1133 · Listmonk · Listmonk

Playeriunknown · Publicado 2026-01-02 · Atualizado 2026-01-17 · CVE-2026-21483

Positive Technologies (AI Summary)

CVSS v4.0

6.4

Média

Vetor base

AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N

Name of the Vulnerable Software and Affected Versions listmonk versions prior to 6.0.0

Description listmonk is a self-hosted newsletter and mailing list manager. A user with campaign management permissions, but lower privileges, can inject malicious JavaScript into campaigns or templates. When a user with higher privileges (Super Admin) views or previews this content, the JavaScript executes in their browser, potentially allowing the attacker to perform privileged actions, such as creating backdoor admin accounts. The issue can be exploited through the public archive feature, requiring only a link visit from the victim, without needing to preview the content. The vulnerable component is the campaign or template functionality.

Recommendations Update to version 6.0.0 or later.

Exploit

Correção

LPE

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2026-21483

GHSA-JMR4-P576-V565

GO-2026-4277

SUSE-SU-2026:0142-1

Produtos afetados

Listmonk

Referências · 45

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/21xxx/CVE-2026-21483.json · Exploit
• https://github.com/knadh/listmonk · Nota
• https://github.com/knadh/listmonk/security/advisories/GHSA-jmr4-p576-v565 · Aviso do Fabricante
• https://github.com/knadh/listmonk/releases/tag/v6.0.0 · Nota
• https://github.com/knadh/listmonk/commit/74dc5a01cfbb12cf218cb33ddad8410c53e2e915 · Nota
• https://suse.com/security/cve/CVE-2025-62877 · Nota
• https://suse.com/security/cve/CVE-2025-68954 · Nota
• https://osv.dev/vulnerability/SUSE-SU-2026:0142-1 · Aviso do Fabricante
• https://suse.com/security/cve/CVE-2017-18895 · Nota
• https://suse.com/security/cve/CVE-2025-14986 · Nota
• https://osv.dev/vulnerability/GHSA-jmr4-p576-v565 · Aviso do Fabricante
• https://twitter.com/CVEnew/status/2007202761499390193 · Publicação no Twitter
• https://twitter.com/VulmonFeeds/status/2007298427361632635 · Publicação no Twitter
• https://suse.com/security/cve/CVE-2017-18893 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2026-21483 · Nota de Segurança