The vulnerability identified as CVE-2024-58302 affects FriendsofFlarum Pretty Mail 1.1.2, where administrative users can exploit improper control of filenames in PHP include/require statements (CWE-98). This flaw permits local file inclusion (LFI) during the processing of email templates, enabling attackers with admin privileges to read arbitrary files on the server, such as /etc/passwd. The vulnerability does not require user interaction and has a network attack vector, but requires high privileges (administrative). The CVSS 4.0 vector indicates high vulnerability confidence and no user interaction is needed. No patch or vendor advisory is currently available, and the product is not a cloud service.

Successful exploitation allows an administrative user to read arbitrary files on the server through email template manipulation. This can lead to disclosure of sensitive system information, potentially aiding further attacks. The impact is limited to users with administrative privileges, and no remote unauthenticated exploitation is indicated. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict administrative access to trusted users only and review email template configurations to avoid inclusion of untrusted input. Monitor vendor channels for updates or patches addressing this vulnerability.