CVE-2025-52691

Published: Dec 29, 2025Modified: Jun 17, 2026CISA KEV

10.0

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Exploitability: 3.9 / Impact: 6.0

Source: 5f57b9bf-260d-4433-bf07-b6a79e9bb7d4 (Secondary)

Description

Successful exploitation of the vulnerability could allow an unauthenticated attacker to upload arbitrary files to any location on the mail server, potentially enabling remote code execution.

Affected (1)

Products: Smartertools: Smartermail

Smartertools

1 product

Smartermail

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Smartertools Smartermail	Before 100.0.9413

Related CWEs

CWE-434

Unrestricted Upload of File with Dangerous Type

The product allows the upload or transfer of dangerous file types that are automatically processed within its environment.

References (3)

https://www.csa.gov.sg/alerts-and-advisories/alerts/al-2025-124/

Source: 5f57b9bf-260d-4433-bf07-b6a79e9bb7d4

Third Party Advisory

https://github.com/watchtowrlabs/watchTowr-vs-SmarterMail-CVE-2025-52691?ref=labs.watchtowr.com

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0

ExploitThird Party Advisory

https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-52691

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0

US Government Resource

Timeline

No history available yet.