CVE-2025-46011
📋 TL;DR
Listmonk v4.1.0 contains a SQL injection vulnerability in the QuerySubscribers function that allows attackers to execute arbitrary SQL commands. This can lead to privilege escalation and unauthorized access to sensitive data. All systems running Listmonk v4.1.0 are affected until patched.
💻 Affected Systems
- Listmonk
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Attackers gain administrative access, exfiltrate all subscriber data, modify or delete database contents, and potentially achieve remote code execution.
Likely Case
Attackers extract sensitive subscriber information (emails, personal data), modify mailing lists, or escalate privileges to administrative accounts.
If Mitigated
Attackers are limited to data extraction from accessible database tables but cannot achieve full system compromise.
🎯 Exploit Status
Exploitation requires some authentication but SQL injection is straightforward once authenticated. Public proof-of-concept exists in GitHub repository.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: v5.0.0
Vendor Advisory: https://github.com/knadh/listmonk/releases/tag/v5.0.0
Restart Required: Yes
Instructions:
1. Backup your Listmonk database and configuration. 2. Stop the Listmonk service. 3. Download and install v5.0.0 from GitHub releases. 4. Run database migrations if required. 5. Restart the Listmonk service. 6. Verify functionality.
🔧 Temporary Workarounds
Input Validation Filter
allImplement strict input validation and parameterized queries for the QuerySubscribers endpoint
WAF Rule
allDeploy web application firewall rules to block SQL injection patterns targeting the vulnerable endpoint
🧯 If You Can't Patch
- Restrict network access to Listmonk administration interface to trusted IP addresses only
- Implement database-level permissions to limit the impact of successful SQL injection
🔍 How to Verify
Check if Vulnerable:
Check Listmonk version via web interface or configuration files. If version is exactly 4.1.0, system is vulnerable.Check Version:
Check the Listmonk web interface dashboard or examine the application configuration files for version information.Verify Fix Applied:
Verify version is 5.0.0 or later. Test QuerySubscribers function with SQL injection test payloads to confirm they are blocked.📡 Detection & Monitoring
Log Indicators:
- Unusual SQL queries in database logs
- Multiple failed login attempts followed by QuerySubscribers access
- Administrative actions from non-admin accounts
Network Indicators:
- SQL keywords in HTTP POST requests to QuerySubscribers endpoint
- Unusual database connection patterns
SIEM Query:
source="listmonk_logs" AND ("QuerySubscribers" AND ("UNION" OR "SELECT *" OR "INSERT" OR "UPDATE" OR "DELETE"))🔗 References
- https://github.com/kevinroleke/security/tree/main/CVE-2025-46011
- https://github.com/knadh/listmonk/commit/4b805f885b9f5a20126ec06f8b59dc448c4af33b
- https://github.com/knadh/listmonk/issues/2412
- https://github.com/knadh/listmonk/releases/tag/v4.1.0
- https://github.com/knadh/listmonk/releases/tag/v5.0.0
