SmarterMail
CVE-2025-52691
CRITICAL
Severity by source
AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Unauthenticated remote upload (AV:N/AC:L/PR:N/UI:N) yields OS-level RCE beyond the app boundary (S:C) with full C/I/A loss, consistent with CWE-434 and the description.
Primary rating from Vendor (5f57b9bf-260d-4433-bf07-b6a79e9bb7d4).
CVSS VectorVendor: 5f57b9bf-260d-4433-bf07-b6a79e9bb7d4
Lifecycle Timeline
4DescriptionCVE.org
Successful exploitation of the vulnerability could allow an unauthenticated attacker to upload arbitrary files to any location on the mail server, potentially enabling remote code execution.
AnalysisAI
Unauthenticated remote code execution in SmarterTools SmarterMail lets an attacker upload arbitrary files to any location on the mail server - including web-executable directories - without credentials and without user interaction. The flaw is rated CVSS 3.1 10.0 (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H), is confirmed actively exploited (CISA KEV), and has publicly available exploit code (watchTowr), making internet-facing instances an urgent priority. Code executed post-exploitation runs with the privileges of the mail service account, effectively handing the attacker the mail server.
Technical ContextAI
The root cause is CWE-434, unrestricted upload of a file with a dangerous type. SmarterMail's web-facing file-upload functionality accepts attacker-controlled files and fails to constrain the destination path or file type, so an unauthenticated request can write content into arbitrary server locations, notably directories that the web/mail service will later execute or serve. That upload-to-write primitive is what converts a file-handling defect into full remote code execution. The CVSS vector's scope change (S:C) reflects that the vulnerable upload component imposes impact well beyond its own security authority - code execution on the underlying host - while PR:N and UI:N confirm the assessment that no authentication and no victim interaction are required, meaning the only prerequisite is HTTP(S) reachability of the SmarterMail endpoint. Impact is bounded only by the privileges of the mail service account under which the executed payload runs; segmentation or network-level restrictions on the instance are the main factors that reduce real-world exposure. The supplied CPE (cpe:2.3:a:smartertools:smartermail:*:*:*:*:*:*:*:*) uses a wildcard version, so exact vulnerable and fixed build ranges are not established by the available data and must be confirmed against vendor guidance before scoping. Compared with a typical high-scoring upload bug, this one is fully unauthenticated and confirmed exploited, so it should be treated as a genuine top-priority vulnerability rather than a high-CVSS paper tiger.
RemediationAI
No vendor-released patch version is identified in the provided data, so the exact fixed build must be confirmed from the CSA Singapore advisory AL-2025-124 (https://www.csa.gov.sg/alerts-and-advisories/alerts/al-2025-124/) and the corresponding SmarterTools vendor advisory before relying on an upgrade for closure; given the CISA KEV listing, apply the vendor's fixed build as soon as it is identified and treat this as a KEV remediation-deadline item for US federal agencies. Until a patched build is confirmed and deployed, the highest-value control is exposure reduction: remove SmarterMail's web interface from the public internet and restrict it to trusted networks or VPN/zero-trust access, accepting the operational cost that remote and mobile mail clients may need alternate access paths. Layer on an authenticating reverse proxy or IP allowlisting in front of the web/upload endpoints - trade-off being that legitimate webmail users must pass through that gate. If the upload functionality is not required for your deployment, disable or block it at the reverse proxy/WAF by rejecting multipart POSTs to the upload handler; validate this against normal attachment workflows, since aggressive blocking can break legitimate mail submission. Run the SmarterMail service under a least-privileged account and isolate it on a segmented host with egress filtering, so that any successful write-and-execute is contained; enforce file-integrity monitoring and alerting on the web-served directories to catch dropped payloads, and review server and web logs for anomalous uploads. Monitor the public watchTowr proof-of-concept (https://github.com/watchtowrlabs/watchTowr-vs-SmarterMail-CVE-2025-52691) to understand the exploit pattern and tune detections, recognizing that publication of exploit code increases the likelihood of opportunistic scanning and mass exploitation.
Windows Win32k fails to properly handle objects in memory, allowing local privilege escalation exploited in the wild in
A privilege escalation vulnerability (CVSS 5.5). Risk factors: actively exploited (KEV-listed), EPSS 94% exploitation pr
Windows Internet Shortcut Files (.url) contain an external control vulnerability (CVE-2025-33053, CVSS 8.8) that enables
Windows SMB contains an improper access control vulnerability (CVE-2025-33073, CVSS 8.8) enabling authenticated attacker
Twonky Server 8.5.2 on Linux and Windows allows unauthenticated access to the admin log file through a web service API b
An unrestricted file upload vulnerability exists in MiniWeb HTTP Server <= Build 300 that allows unauthenticated remote
FreeFloat FTP Server contains multiple critical design flaws that allow unauthenticated remote attackers to upload arbit
Serviio Media Server versions 1.4 through 1.8 on Windows contain an unauthenticated command injection in the /rest/actio
Twonky Server 8.5.2 uses hard-coded cryptographic keys for encrypting the administrator password. Combined with the cred
Mako Server versions 2.5 and 2.6 contain an unauthenticated OS command injection via the tutorial interface at examples/
React Native Metro Development Server binds to external interfaces by default and contains an OS command injection endpo
External control of file name or path in Windows NTLM allows an unauthorized attacker to perform spoofing over a network
Share
External POC / Exploit Code
Leaving vuln.today