by Kastro
Paper/Archive/CVE-2025-52691

CVE-2025-52691

SmarterTools SmarterMail — Upload Arbitrary Files

KEV · due 16 Febransomware useEPSS 86%public exploitSSVC actCVSS 10.0
critical.is priorityof 100
100
CVSS 10.0 (CNA)10.0 / 10 × 3030.0In CISA KEV+3030.0EPSS percentile 99.7.997 × 2019.9Exploit: SSVC active+1010.0SSVC exploitation: active+1010.0
Description · from the CVE record

Successful exploitation of the vulnerability could allow an unauthenticated attacker to upload arbitrary files to any location on the mail server, potentially enabling remote code execution.

Affected

ProductAffectedFixed inSource
SmarterMailSmarterMail versions Build 9406 and earlier–CNA

Scores by source

CSA (CNA)10.0CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
CISA ADPSSVCExploitation: active · Automatable: yes · Technical impact: total

References

refcsa.gov.sg/alerts-and-advisories/alerts/al-2025-124exploitgithub.com/watchtowrlabs/watchTowr-vs-SmarterMail-CVE-2025-52691?ref=labs.watchtowr.comrefcisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-52691kevcisa.gov/known-exploited-vulnerabilities-catalog