Critical · published December 29, 2025
CVSS calls it critical at 10.0. It is confirmed in active exploitation. It sits in the 99.7th percentile for exploit probability.
🚨 An unauthenticated attacker can upload arbitrary files to your mail server, and that’s a recipe for disaster! 🔥 Imagine a hotel where anyone can drop off any package without being checked in — it opens the door to all sorts of trouble! 🎁 Just like that, this vulnerability lets attackers plant malicious files anywhere on the server. If exploited, this vulnerability could lead to remote code execution, granting attackers full control over the mail server. They could read sensitive information, modify data, or even launch attacks against other systems. It’s absolutely devastating!
Imagine a hotel where anyone can drop off any package without being checked in — it opens the door to all sorts of trouble! 🎁 Just like that, this vulnerability lets attackers plant malicious files anywhere on the server. CVE-2025-52691 allows attackers to upload files without authentication due to insufficient security checks on file uploads, enabling potentially harmful files to be executed on the server.
If exploited, this vulnerability could lead to remote code execution, granting attackers full control over the mail server. They could read sensitive information, modify data, or even launch attacks against other systems. It’s absolutely devastating! Immediately patch the mail server to the latest version that addresses CVE-2025-52691. Implement strict validation and sanitization on file uploads to mitigate this vulnerability. Regularly audit server configurations to prevent similar flaws! You've got this! Follow these steps to secure your mail server and keep the bad guys out! 🛡️
| Product | Versions | Fixed in |
|---|---|---|
| smartertools/smartermail | < 100.0.9413 | 100.0.9413 |