CVE-2025-59689
Libraesva Email Security Gateway Command Injection Vulnerability
Description
CVE-2025-59689 is a medium-severity command injection vulnerability in Libraesva Email Security Gateway (ESG) versions 4.5 through 5.5.x before 5.5.7. The vulnerability allows attackers to inject commands through a compressed email attachment, leveraging the gateway's attachment processing mechanism. With a CVSS v3.1 base score of 6.1, this vulnerability has a changed scope that enables the attacker to affect resources beyond the vulnerable component. CISA has added CVE-2025-59689 to the Known Exploited Vulnerabilities catalog with a remediation deadline of October 20, 2025, and its EPSS score of 5.22% at the 90th percentile indicates notable exploitation probability for an email security appliance.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:NOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| libraesva | email security gateway | >= 4.5, < 5.0.31; >= 5.1.0, < 5.1.20; >= 5.2.0, < 5.2.31; >= 5.3.0, < 5.3.16; >= 5.4.0, < 5.4.8; >= 5.5.0, < 5.5.7 |
References
- https://docs.libraesva.com/knowledgebase/security-advisory-command-injection-vulnerability-cve-2025-59689/(Vendor Advisory)
- https://www.libraesva.com/security-blog/(Vendor Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-59689(US Government Resource)
Weakness Type
CWE-77: Command Injection
CVE-2025-59689 is classified under CWE-77 (Improper Neutralization of Special Elements used in a Command), which occurs when software constructs commands using externally-influenced input without proper neutralization. In the Libraesva Email Security Gateway, the processing pipeline for compressed email attachments fails to properly sanitize input, allowing an attacker to embed command injection payloads within crafted compressed attachments that are executed when the gateway processes the email.
Learn more: CWE-77 — Improper Neutralization of Special Elements used in a Command ('Command Injection')
Impact Analysis
CVE-2025-59689 affects the security posture of organizations relying on Libraesva ESG for email protection. The vulnerability is remotely exploitable over the network (AV:N) with low attack complexity (AC:L) and no authentication required (PR:N), though user interaction is required (UI:R) in the form of sending an email with a crafted attachment. The scope is changed (S:C), meaning the exploit can impact resources beyond the email gateway itself. Confidentiality (Low): The attacker can gain limited access to data processed by the email gateway, potentially including email contents and configuration information. Integrity (Low): Command injection allows limited modification of the gateway's behavior and data. Availability: No direct availability impact is noted in the CVSS metrics. With a CVSS score of 6.1 (Medium) and the target being an email security gateway — a device that processes all inbound email for an organization — even a medium-severity command injection vulnerability represents a significant risk. The EPSS score of 5.22% at the 90th percentile and the confirmed active exploitation underscore that this Libraesva ESG vulnerability is being actively targeted.
Exploit Maturity
CVE-2025-59689 has confirmed active exploitation in the wild. CISA has added this vulnerability to the Known Exploited Vulnerabilities catalog, confirming that threat actors are actively exploiting Libraesva Email Security Gateway installations. The EPSS score of 5.22% at the 90th percentile indicates exploitation probability in the top 10% of all vulnerabilities. The Libraesva security advisory at docs.libraesva.com provides the vendor's official disclosure. Email security gateways are particularly attractive targets for attackers because they process all inbound email traffic and often have elevated privileges within the network infrastructure. The ability to trigger the vulnerability by simply sending an email with a crafted compressed attachment makes the attack vector accessible without any prior access to the target organization.
Remediation
-
Upgrade Libraesva ESG immediately to a patched version. Specific fixed versions are available for each branch: ESG 5.0 should upgrade to 5.0.31, ESG 5.1 to 5.1.20, ESG 5.2 to 5.2.31, ESG 5.3 to 5.3.16, ESG 5.4 to 5.4.8, and ESG 5.5 to 5.5.7. The CISA required action states to apply mitigations per vendor instructions or discontinue use of the product.
-
Review email processing configurations. As an interim mitigation, consider restricting or quarantining compressed attachments until the patch is applied. Configure the gateway to block or hold emails with compressed attachments from untrusted external sources for manual review.
-
Implement upstream email filtering as a compensating control. Deploy additional email filtering at the MTA level or use a secondary email security service to inspect compressed attachments before they reach the Libraesva gateway. This defense-in-depth approach reduces the risk of exploitation during the patching window.
-
Audit gateway logs for indicators of compromise. Review Libraesva ESG processing logs for unusual patterns in compressed attachment handling, unexpected command execution, and anomalous outbound network connections from the gateway. Check for unauthorized configuration changes and signs of data exfiltration.
-
Harden the gateway environment. Ensure the email gateway runs with minimal system privileges, implement network segmentation to isolate the gateway from critical internal resources, and enable comprehensive logging for all gateway operations. Regularly update the gateway to address future command injection vulnerabilities in attachment processing.
Technical Details
CVE-2025-59689 is a command injection vulnerability in the Libraesva Email Security Gateway's compressed attachment processing pipeline. The CVSS v3.1 vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N indicates the vulnerability is network-exploitable with low complexity and no authentication, but requires user interaction (sending an email), with changed scope and low confidentiality and integrity impact. The vulnerability is rooted in CWE-77 (Command Injection). When the Libraesva ESG processes inbound emails containing compressed attachments (e.g., ZIP, RAR, or similar archive formats), the decompression and scanning pipeline constructs system commands that incorporate metadata or content from the compressed file without proper sanitization. An attacker can craft a compressed attachment with specially designed filenames, paths, or metadata containing shell metacharacters that are interpreted as commands when processed by the gateway's decompression routine. The changed scope (S:C) indicates that the command execution can affect resources beyond the email processing component itself. Affected versions span ESG 4.5 through multiple 5.x branches, with specific fixes released across six version branches.
Frequently Asked Questions
Is CVE-2025-59689 being actively exploited?
Yes. CISA has confirmed active exploitation by adding CVE-2025-59689 to the Known Exploited Vulnerabilities catalog with a remediation deadline of October 20, 2025. The EPSS score of 5.22% at the 90th percentile indicates notable exploitation activity targeting Libraesva Email Security Gateway installations.
What products are affected by CVE-2025-59689?
Libraesva Email Security Gateway versions 4.5 through 5.5.x are affected. Specific patched versions are: 5.0.31, 5.1.20, 5.2.31, 5.3.16, 5.4.8, and 5.5.7. Organizations running any version in the 4.5 through 5.5 range should upgrade to the appropriate patched release for their branch.
How do I fix CVE-2025-59689?
Upgrade to the patched version for your ESG branch: 5.0.31, 5.1.20, 5.2.31, 5.3.16, 5.4.8, or 5.5.7. As an interim measure, consider quarantining compressed email attachments from external sources and implementing additional upstream email filtering.
How severe is CVE-2025-59689?
CVE-2025-59689 is rated Medium with a CVSS v3.1 base score of 6.1. While the direct impact is limited to low confidentiality and integrity compromise, the changed scope means the attack can affect systems beyond the email gateway. The target — an email security appliance — processes all organizational email, making any command injection vulnerability on such a device a significant concern.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.