FriendsofFlarum Pretty Mail 1.1.2 contains a CWE-1336 vulnerability involving improper neutralization of special elements in its template engine. This server-side template injection (SSTI) enables administrative users to execute system commands by inserting crafted expressions into email templates, which are processed during email generation. The CVSS 4.0 base score is 8.6, indicating high severity with network attack vector, low attack complexity, no user interaction, and high impacts on confidentiality, integrity, and availability.

Successful exploitation allows an attacker with administrative privileges to execute arbitrary system commands on the server hosting the Pretty Mail extension. This can lead to full compromise of the affected system, including data theft, service disruption, or further lateral movement within the environment. Since the vulnerability is in a template engine used for email generation, it may be triggered during normal email sending operations.

No official patch or remediation is currently available for this vulnerability. Users should restrict administrative access to trusted personnel only and monitor for unusual activity related to email template modifications. Check the vendor advisory regularly for updates or patches addressing this issue. Avoid using version 1.1.2 of FriendsofFlarum Pretty Mail in production environments until a fix is released.