CVE-2024-58302: Flarum Friendsofflarum Pretty Mail

Medium severity, CVSS 6.9. EPSS: 0.3% chance of exploitation in the next 30 days.

FoF Pretty Mail 1.1.2 contains a local file inclusion vulnerability that allows administrative users to include arbitrary server files in email templates. Attackers can exploit the template settings by inserting file inclusion payloads to read sensitive system files like /etc/passwd during email generation.

Affected products

• Flarum Friendsofflarum Pretty Mail: version 1.1.2 only

Published 2025-12-11. Last modified 2026-06-17.