CVE-2025-58430: listmonk Vulnerable to CSRF to XSS Chain That Can Lead to Admin Account Takeover

Vulnerability summary

CVE-2025-58430 is a high (CVSS 8.6) vulnerability in knadh listmonk. EPSS estimates a 0.14% chance of exploitation in the next 30 days, higher than 3% of scored vulnerabilities. 1 public exploit is recorded.

Timeline

1. 09-09-2025
   PublishedVulnerability first disclosed.
2. 10-09-2025
   Last modifiedVulnerability information updated.

Description

listmonk is a standalone, self-hosted, newsletter and mailing list manager. In versions up to and including 1.1.0, every http request in addition to the session cookie `session` there included `nonce`. The value is not checked and validated by the backend, removing `nonce` allows the requests to be processed correctly. This may seem harmless, but if chained to other vulnerabilities it can become a critical vulnerability. Cross-site request forgery and cross-site scripting chained together can result in improper admin account creation. As of time of publication, no patched versions are available.

• CWE-79Improper Neutralization of Input During Web Page GenerationThe product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
• CWE-80Improper Neutralization of Script-Related HTML Tags in a Web PageThe product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes special characters such as "<", ">", and "&" that could be interpreted as web-scripting elements when they are sent to a downstream component that processes web pages.
• CWE-352Cross-Site Request ForgeryThe web application does not, or cannot, sufficiently verify whether a request was intentionally provided by the user who sent the request, which could have originated from an unauthorized actor.