CVE-2025-52691
SmarterTools SmarterMail Unrestricted Upload of File with Dangerous Type Vulnerability
Description
CVE-2025-52691 is a critical unrestricted file upload vulnerability in SmarterTools SmarterMail with a maximum CVSS v3.1 base score of 10.0 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H). The vulnerability allows an unauthenticated attacker to upload arbitrary files to any location on the mail server, potentially enabling remote code execution. SmarterMail versions prior to 100.0.9413 are affected. This vulnerability is listed in CISA's Known Exploited Vulnerabilities (KEV) catalog with a remediation deadline of February 16, 2026, and has an extremely high EPSS score of 0.78375 (99.0th percentile), indicating it is actively being targeted in the wild. Public exploit code is available through watchTowr Labs.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| smartertools | smartermail | < 100.0.9413 |
References
- https://www.csa.gov.sg/alerts-and-advisories/alerts/al-2025-124/(Third Party Advisory)
- https://github.com/watchtowrlabs/watchTowr-vs-SmarterMail-CVE-2025-52691?ref=labs.watchtowr.com(Exploit, Third Party Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-52691(US Government Resource)
Weakness Type
CWE-434: Unrestricted Upload of File with Dangerous Type
CVE-2025-52691 is classified under CWE-434, which describes software that allows the upload of files without properly verifying that the file type is safe and expected. In the case of SmarterMail, the application fails to restrict the types and destinations of uploaded files, enabling an attacker to upload executable content such as web shells, scripts, or compiled binaries to arbitrary locations on the server's file system. This weakness is particularly dangerous in web-facing applications because an uploaded executable file placed in a web-accessible directory can be directly invoked by the attacker to achieve remote code execution. Learn more about CWE-434
Impact Analysis
Remote Code Execution Without Authentication is the most severe consequence of CVE-2025-52691. An attacker requires no credentials or prior access to exploit this vulnerability, and successful exploitation provides the ability to execute arbitrary code on the mail server with the privileges of the SmarterMail service account. This represents a complete compromise of the server.
Confidentiality Impact is maximum (C:H) with changed scope (S:C). The attacker can access all email data stored on the server, including messages, attachments, address books, and credentials for all mail accounts. Because the scope is changed, the impact extends beyond the vulnerable SmarterMail component to other resources on the same system and potentially the broader network. Email servers typically contain highly sensitive business communications, personal data, and authentication credentials.
Integrity Impact is maximum (I:H). With arbitrary file upload and code execution, the attacker can modify email content, inject malicious attachments into existing messages, alter server configurations, install persistent backdoors, and tamper with logs to conceal their activities. The ability to manipulate email in transit or at rest enables sophisticated business email compromise scenarios.
Availability Impact is maximum (A:H). The attacker can disable the mail server, delete email data, encrypt files for ransomware purposes, or consume server resources to cause denial of service. For organizations relying on SmarterMail as their primary email infrastructure, this could result in a complete communications outage.
Scale and Severity Context: The CVSS score of 10.0 is the maximum possible rating, reflecting the combination of network-accessible attack vector, no authentication requirement, low complexity, no user interaction, and changed scope with maximum impact across all three dimensions. The EPSS score of 0.78375 (99.0th percentile) confirms extreme real-world exploitation activity. CISA lists the ransomware association as "Unknown."
Exploit Maturity
CVE-2025-52691 is confirmed as actively exploited in the wild, as evidenced by its inclusion in CISA's Known Exploited Vulnerabilities (KEV) catalog with a remediation deadline of February 16, 2026. The EPSS score of 0.78375 places it in the 99.0th percentile, indicating that this vulnerability is among the most actively targeted in the current threat landscape.
Public Exploit Availability: A fully functional exploit has been published by watchTowr Labs and is available on GitHub at watchTowr-vs-SmarterMail-CVE-2025-52691. The availability of a public, weaponized exploit significantly lowers the barrier for exploitation, enabling both sophisticated threat actors and less skilled attackers to target vulnerable SmarterMail instances.
Attack Surface: SmarterMail servers are typically internet-facing to provide email services, creating a large and easily discoverable attack surface. The vulnerability requires no authentication and no user interaction, meaning automated scanning and exploitation at scale is straightforward. The Cyber Security Agency of Singapore (CSA) has issued an alert regarding this vulnerability, underscoring its international significance.
Ransomware Association: CISA lists the ransomware association as "Unknown." However, given the ease of exploitation, the full remote code execution capability, and the high value of email servers as targets, this vulnerability is an attractive candidate for ransomware operators seeking initial access to organizations.
Remediation
-
Upgrade SmarterMail to version 100.0.9413 or later immediately. This is the only complete remediation for CVE-2025-52691. The update addresses the unrestricted file upload vulnerability by implementing proper file type validation and upload destination restrictions. Given the availability of public exploits and active exploitation, this update should be treated as an emergency priority.
-
Restrict network access to the SmarterMail web interface as an immediate mitigation while planning the upgrade. Use firewall rules or a reverse proxy to limit access to the SmarterMail administration and webmail interfaces to trusted IP ranges only. While this does not eliminate the vulnerability, it reduces the attack surface by preventing exploitation from arbitrary internet sources.
-
Audit the server for indicators of compromise before and after patching. Check for unexpected files in web-accessible directories, particularly executable files such as .aspx, .ashx, .asmx, or .dll files that may represent web shells. Review server access logs for unusual upload requests, and examine running processes for unauthorized activity. The watchTowr Labs research provides details on exploitation patterns that can guide forensic investigation.
-
Implement web application firewall (WAF) rules to detect and block file upload attempts targeting the vulnerable endpoints. Configure the WAF to inspect upload requests for executable file extensions and suspicious content types. This provides a defense-in-depth layer that can block exploitation attempts even if the underlying vulnerability has not yet been patched.
-
Review and harden SmarterMail service account permissions. Ensure that the SmarterMail service runs with the minimum necessary operating system privileges. Restrict the service account's write access to only the directories required for normal operation, preventing an attacker from writing files to arbitrary locations even if the upload vulnerability is exploited.
Technical Details
CVE-2025-52691 is an unrestricted file upload vulnerability in SmarterTools SmarterMail affecting versions prior to 100.0.9413. The vulnerability exists because the application fails to properly validate and restrict file uploads, allowing an unauthenticated attacker to write arbitrary files to any location on the mail server's file system.
CVSS Vector Breakdown: The vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H represents the maximum possible CVSS score of 10.0. The attack vector is network-based (AV:N), meaning the vulnerability can be exploited remotely over the internet. Attack complexity is low (AC:L), indicating no special conditions or configurations are needed. No privileges are required (PR:N), so any anonymous attacker can exploit the flaw. No user interaction is needed (UI:N), enabling fully automated exploitation. The scope is changed (S:C), meaning successful exploitation impacts resources beyond the vulnerable SmarterMail component itself. All three impact dimensions are high (C:H/I:H/A:H).
Attack Mechanism: The vulnerability allows an attacker to send crafted HTTP requests to the SmarterMail server that bypass file upload restrictions. The application fails to adequately validate the file type, file content, and the destination path specified in the upload request. This enables the attacker to upload files with dangerous extensions (such as .aspx web shells) to web-accessible directories, or to overwrite critical system files. Once an executable file is placed in a web-accessible directory, the attacker can invoke it through a subsequent HTTP request to achieve remote code execution.
Exploitation Flow: A typical exploitation scenario involves the attacker uploading a web shell (such as an ASPX file) to the SmarterMail webroot directory. The attacker then accesses the uploaded web shell through a direct URL, gaining an interactive command execution interface on the server. From this foothold, the attacker can execute operating system commands, access email data, pivot to other systems on the network, or deploy additional malware.
Service Context: SmarterMail runs as a Windows service, and the uploaded files execute with the permissions of that service account. On many installations, this service runs with elevated privileges to manage email delivery, DNS lookups, and system-level operations, amplifying the impact of code execution.
Frequently Asked Questions
What is CVE-2025-52691?
CVE-2025-52691 is a critical unrestricted file upload vulnerability in SmarterTools SmarterMail with a maximum CVSS score of 10.0. It allows an unauthenticated attacker to upload arbitrary files to any location on the mail server, potentially achieving remote code execution. Versions prior to 100.0.9413 are affected.
How do I know if my SmarterMail server is vulnerable?
Check your SmarterMail version by navigating to the About section in the administration console. Any version prior to 100.0.9413 is vulnerable. Given the active exploitation and availability of public exploits, all unpatched SmarterMail instances should be considered at immediate risk.
Is there a public exploit for CVE-2025-52691?
Yes. watchTowr Labs has published a fully functional exploit on GitHub. The availability of this public exploit means that both sophisticated and less skilled attackers can target vulnerable SmarterMail installations. This significantly increases the urgency of patching.
What should I do if my SmarterMail server has already been compromised?
If you suspect compromise, immediately isolate the server from the network to prevent further lateral movement. Conduct a forensic examination of the file system, focusing on web-accessible directories for uploaded web shells (.aspx, .ashx files). Review access logs, email queues, and active connections for anomalous activity. After the investigation, rebuild the server from a known-clean backup and apply the patch before bringing it back online.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.