CVE-2025-59689

Published Sep 19, 2025

Last updated 4 months ago

Exploit known CVSS medium 6.1

Libraesva Email Security Gateway

SMTP

Overview

Description: Libraesva ESG 4.5 through 5.5.x before 5.5.7 allows command injection via a compressed e-mail attachment. For ESG 5.0 a fix has been released in 5.0.31. For ESG 5.1 a fix has been released in 5.1.20. For ESG 5.2 a fix has been released in 5.2.31. For ESG 5.4 a fix has been released in 5.4.8. For ESG 5.5. a fix has been released in 5.5.7.
Source: cve@mitre.org
NVD status: Analyzed
Products: email_security_gateway

Risk scores

CVSS 3.1

Type: Secondary
Base score: 6.1
Impact score: 2.7
Exploitability score: 2.8
Vector string: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Severity: MEDIUM

Known exploits

Data from CISA

Vulnerability name: Libraesva Email Security Gateway Command Injection Vulnerability
Exploit added on: Sep 29, 2025
Exploit action due: Oct 20, 2025
Required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Weaknesses

cve@mitre.org: CWE-77

Hype score: Not currently trending

Configurations

[
  {
    "nodes": [
      {
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:a:libraesva:email_security_gateway:*:*:*:*:*:*:*:*",
            "matchCriteriaId": "C7388039-AE70-47F1-A389-EF05FCB34E61",
            "versionEndExcluding": "5.0.31",
            "versionStartIncluding": "4.5",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:a:libraesva:email_security_gateway:*:*:*:*:*:*:*:*",
            "matchCriteriaId": "A280A808-E1F6-4B0A-B44F-47E5C9152B36",
            "versionEndExcluding": "5.1.20",
            "versionStartIncluding": "5.1.0",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:a:libraesva:email_security_gateway:*:*:*:*:*:*:*:*",
            "matchCriteriaId": "62A71B25-7262-43CC-94E8-C92CC5932D86",
            "versionEndExcluding": "5.2.31",
            "versionStartIncluding": "5.2.0",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:a:libraesva:email_security_gateway:*:*:*:*:*:*:*:*",
            "matchCriteriaId": "EDC45835-D39B-47A1-BE61-42CD7ACD6988",
            "versionEndExcluding": "5.3.16",
            "versionStartIncluding": "5.3.0",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:a:libraesva:email_security_gateway:*:*:*:*:*:*:*:*",
            "matchCriteriaId": "C2D53E14-0C5F-4DE0-8785-F59A85107D9C",
            "versionEndExcluding": "5.4.8",
            "versionStartIncluding": "5.4.0",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:a:libraesva:email_security_gateway:*:*:*:*:*:*:*:*",
            "matchCriteriaId": "7CF82183-A726-4FEE-95FA-4062C5F7FEEB",
            "versionEndExcluding": "5.5.7",
            "versionStartIncluding": "5.5.0",
            "vulnerable": true
          }
        ],
        "negate": false,
        "operator": "OR"
      }
    ]
  }
]

References

Sources include official advisories and independent security research.

Overview

Risk scores

CVSS 3.1

Known exploits

Weaknesses

Social media

Configurations

Related CVEs

References