CVE-2025-59689

Published Sep 19, 2025

Last updated 3 days ago

Libraesva Email Security Gateway

Overview

AI description

Automated description summarized from trusted sources.

CVE-2025-59689 is a command injection vulnerability affecting Libraesva Email Security Gateway (ESG) versions 4.5 through 5.5.x before 5.5.7. It stems from improper sanitization when the software removes active code from files within certain compressed archive formats. Attackers can exploit this vulnerability by sending emails containing specially crafted compressed attachments. The payload files are designed to manipulate the application's sanitization logic, allowing the execution of arbitrary shell commands under a non-privileged user account. Fixes have been released for ESG versions 5.0, 5.1, 5.2, 5.4, and 5.5.

Description: Libraesva ESG 4.5 through 5.5.x before 5.5.7 allows command injection via a compressed e-mail attachment. For ESG 5.0 a fix has been released in 5.0.31. For ESG 5.1 a fix has been released in 5.1.20. For ESG 5.2 a fix has been released in 5.2.31. For ESG 5.4 a fix has been released in 5.4.8. For ESG 5.5. a fix has been released in 5.5.7.
Source: cve@mitre.org
NVD status: Awaiting Analysis

Risk scores

CVSS 3.1

Type: Secondary
Base score: 6.1
Impact score: 2.7
Exploitability score: 2.8
Vector string: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Severity: MEDIUM

Weaknesses

cve@mitre.org: CWE-77

Hype score: Not currently trending

References