{"action":"No fix published. Pin and monitor.","affected":[{"introduced":"0","last_affected":"1.1.2"}],"component":"fof/pretty-mail","cve_ids":["CVE-2024-58303"],"ecosystem":"Packagist","epss":0.00539,"exploited":false,"fixed_versions":[],"ghsa_id":"GHSA-947q-2xw3-gx9c","id":"tcs_01M5KEZKYJYJCTQMKC1PH83T47","modified_at":"2025-12-12T16:56:14.962289Z","published_at":"2025-12-12T00:30:21Z","references":["https://osv.dev/vulnerability/GHSA-947q-2xw3-gx9c","https://nvd.nist.gov/vuln/detail/CVE-2024-58303","https://flarum.org","https://github.com/FriendsOfFlarum/pretty-mail","https://www.exploit-db.com/exploits/51948","https://www.vulncheck.com/advisories/fof-pretty-mail-server-side-template-injection-via-email-template-settings"],"severity":{"label":"high","score":8.6},"sources":[{"source":"osv","source_id":"GHSA-947q-2xw3-gx9c","url":"https://osv.dev/vulnerability/GHSA-947q-2xw3-gx9c"},{"source":"nvd","source_id":"CVE-2024-58303","url":"https://nvd.nist.gov/vuln/detail/CVE-2024-58303"}],"summary":"FoF Pretty Mail has a server-side template injection vulnerability"}