CVE-2025-59689

Published: Sep 19, 2025Modified: Jun 17, 2026CISA KEV

6.1

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Exploitability: 2.8 / Impact: 2.7

Source: MITRE (Secondary)

Description

Libraesva ESG 4.5 through 5.5.x before 5.5.7 allows command injection via a compressed e-mail attachment. For ESG 5.0 a fix has been released in 5.0.31. For ESG 5.1 a fix has been released in 5.1.20. For ESG 5.2 a fix has been released in 5.2.31. For ESG 5.4 a fix has been released in 5.4.8. For ESG 5.5. a fix has been released in 5.5.7.

Affected (6)

Products: Libraesva: Email Security Gateway

Libraesva

1 product

Email Security Gateway

Configuration A

6 vulnerable

Vulnerable Software	Affected Versions
Libraesva Email Security Gateway	From 4.5 to 5.0.31
Libraesva Email Security Gateway	From 5.1.0 to 5.1.20
Libraesva Email Security Gateway	From 5.2.0 to 5.2.31
Libraesva Email Security Gateway	From 5.3.0 to 5.3.16
Libraesva Email Security Gateway	From 5.4.0 to 5.4.8
Libraesva Email Security Gateway	From 5.5.0 to 5.5.7

Related CWEs

CWE-77

Improper Neutralization of Special Elements used in a Command ('Command Injection')

The product constructs all or part of a command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended command when it is sent to a downstream component.

References (3)

https://docs.libraesva.com/knowledgebase/security-advisory-command-injection-vulnerability-cve-2025-59689/

Source: cve@mitre.org

Vendor Advisory

https://www.libraesva.com/security-blog/

Source: cve@mitre.org

Vendor Advisory

https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-59689

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0

US Government Resource

Timeline

No history available yet.