Critical SmarterMail Vulnerability Allowing Unauthenticated Arbitrary File Upload (CVE-2025-52691)
A critical vulnerability identified as CVE-2025-52691 has been discovered in SmarterMail, allowing unauthenticated attackers to upload arbitrary files to any location on the mail server. This flaw, rated with a CVSS score of 10, enables remote code execution, potentially giving attackers full control over affected servers. The vulnerability can be exploited without authentication, significantly increasing the risk of compromise for organizations running vulnerable versions of SmarterMail.
Security advisories emphasize the severity of this issue, warning that successful exploitation could lead to the deployment of web shells or other malicious payloads, facilitating further attacks or persistent access. Organizations using SmarterMail are urged to apply available patches immediately and review server logs for signs of unauthorized file uploads or suspicious activity.
Timeline
Dec 30, 2025
SmarterMail identified as affected by CVE-2025-52691
Subsequent reporting identified SmarterMail as the affected mail server product exposed by CVE-2025-52691. The flaw was described as remotely exploitable without authentication, putting exposed SmarterMail servers at risk of compromise.
Dec 29, 2025
CVE-2025-52691 published as critical arbitrary file upload flaw
CVE-2025-52691 was published as a critical vulnerability affecting mail servers, allowing unauthenticated attackers to upload arbitrary files to server locations and potentially achieve remote code execution. The issue was assigned a CVSS 3.1 score of 10.0, reflecting maximum severity.
See the full picture in Mallory
Mallory subscribers get deeper analysis on every story, including:
Who’s affected and how
Deep-dive technical analysis
Actionable next steps for your team
IPs, domains, hashes, and more
Ask questions and take action on every story
Filter by topic, classification, timeframe
Get matching stories delivered automatically
Related Entities
Vulnerabilities
Affected Products
Sources
Related Stories
Critical Remote Code Execution Vulnerability in SmarterMail
A critical remote code execution (RCE) vulnerability, tracked as CVE-2025-52691, has been identified in SmarterMail, affecting Build 9406 and earlier. This flaw allows unauthenticated attackers to upload arbitrary files to any location on the mail server, enabling them to execute remote code and potentially gain full control over compromised systems. The vulnerability has been assigned a CVSS score of 10.0, indicating maximum severity, and poses a significant risk of unauthorized access, data exfiltration, malware deployment, and lateral movement within affected networks. SmarterTools has released Build 9413 to address this issue, and immediate patching is strongly advised to mitigate the threat. The vulnerability was discovered by Chua Meng Han from the Centre for Strategic Infocomm Technologies (CSIT), with responsible disclosure coordinated by the Cyber Security Agency (CSA) of Singapore. Security advisories from both SmarterTools and the Canadian Centre for Cyber Security urge all users and administrators to verify their SmarterMail version and apply the update to Build 9413 or later without delay. Failure to patch leaves organizations exposed to active exploitation and potential compromise of sensitive email communications and infrastructure.
1 months ago
SmarterMail Unauthenticated File Upload RCE (CVE-2025-52691) Exposes Thousands of Internet-Facing Servers
A critical SmarterTools *SmarterMail* vulnerability, **CVE-2025-52691**, enables **remote code execution (RCE)** via an **unauthenticated arbitrary file upload** condition (CWE-434). The issue affects SmarterMail **Build 9406 and earlier** and is fixed in **Build 9413 and later**; the NVD lists a **CVSS v3.1 score of 10.0** (`CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H`). Successful exploitation can allow full server compromise, including webshell deployment, data theft, and lateral movement under the service’s privileges. Internet-wide scanning reported **8,001 likely vulnerable IPs** out of **18,783** exposed SmarterMail instances (about **42.6%** failing checks), with the largest concentration in the **United States (~5,000)** followed by the **UK** and **Malaysia**. **Public proof-of-concept exploit code** is available, increasing the likelihood of opportunistic exploitation against unpatched, internet-facing deployments; multiple national agencies reportedly issued advisories following disclosure in late December 2025.
1 months ago
SmarterMail flaw lets attackers forge sharing tokens and access email contents
SmarterTools disclosed a vulnerability in **SmarterMail** affecting versions prior to **Build 9610**, and national advisories have urged administrators to apply the vendor update. The issue is tracked as **CVE-2026-40514** and has also been referenced in **dCERT Advisory 2026-1257** and the Canadian Centre for Cyber Security notice **AV26-398**, both pointing users to SmarterTools' remediation guidance for affected deployments. According to the CVE entry, SmarterMail's file and email sharing endpoints used **DES-CBC** encryption with keys and IVs derived from `System.Random`, leaving a seed space of roughly 19,000 values. An unauthenticated attacker could use the attachment download endpoint as an oracle to recover the active seed, derive the encryption material, and forge sharing tokens to access arbitrary emails, attachments, or file storage contents without prior authorization, creating a high-impact confidentiality risk.
3 days ago