Executive brief
listmonk: CSRF to XSS Chain can Lead to Admin Account Takeover in github.com/knadh/listmonk
Affected products
- Go github.com/knadh/listmonk
Junglewise Threat Intelligence
CVE-2025-58430: GO-2025-3943 - listmonk: CSRF to XSS Chain can Lead to Admin Account Takeover in github.com/knadh/listmonk
CVE-2025-58430 · Severity: medium · CVSS 4 · Published 2025-09-17
Technologies: github.com/knadh/listmonk (Go). Vendors: Go.
Related threats
- knadh listmonk insufficient session expiration after password change
- GO-2026-4277 - listmonk Vulnerable to Stored XSS Leading to Admin Account Takeover in github.com/knadh/listmonk
- GO-2025-3745 - listmonk's Sprig template Injection vulnerability leads to reading of Environment Variable for low privilege user in github.com/knadh/listmo