CVE-2025-52691

Published Dec 29, 2025

Last updated a month ago

SmarterMail

Overview

AI description

Automated description summarized from trusted sources.

CVE-2025-52691 is a vulnerability in SmarterMail versions Build 9406 and earlier. It allows an unauthenticated attacker to upload arbitrary files to any location on the mail server. This vulnerability can lead to remote code execution, potentially giving attackers complete control over compromised systems. Exploitation could result in unauthorized access to sensitive email communications, malware deployment, data exfiltration, and lateral movement within corporate networks.

Description: Successful exploitation of the vulnerability could allow an unauthenticated attacker to upload arbitrary files to any location on the mail server, potentially enabling remote code execution.
Source: 5f57b9bf-260d-4433-bf07-b6a79e9bb7d4
NVD status: Analyzed
Products: smartermail

Risk scores

CVSS 3.1

Type: Secondary
Base score: 10
Impact score: 6
Exploitability score: 3.9
Vector string: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Severity: CRITICAL

Known exploits

Data from CISA

Vulnerability name: SmarterTools SmarterMail Unrestricted Upload of File with Dangerous Type Vulnerability
Exploit added on: Jan 26, 2026
Exploit action due: Feb 16, 2026
Required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Weaknesses

134c704f-9b21-4f2e-91b3-4a467353bcc0: CWE-434

Hype score: Not currently trending

Configurations

[
  {
    "nodes": [
      {
        "negate": false,
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:a:smartertools:smartermail:*:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "A9F4301A-C277-47F6-841D-386EDD24EE67",
            "versionEndExcluding": "100.0.9413"
          }
        ],
        "operator": "OR"
      }
    ]
  }
]

References

Sources include official advisories and independent security research.