SmarterTools SmarterMail: Unauthenticated remote code execution (CVE-2025-52691)
CVE-2025-52691 is a critical arbitrary file upload vulnerability in SmarterMail (Build 9406 and earlier) that enables unauthenticated remote code execution, with multiple proof-of-concept exploits publicly available.
CVE search metadata
CVE search record: CVE-2025-52691. Severity: critical. CVSS: 10.0. EPSS: 85.66%. KEV: no. Product: SmarterMail (< 100.0.9413). Brief: SmarterTools SmarterMail: Unauthenticated remote code execution (CVE-2025-52691). Brief link: https://feed.craftedsignal.io/briefs/2026-10-smartermail-rce/
Triage facts
Revision 1- Applicability
- SmarterMail (< 100.0.9413)
- Evidence
- Unknown
- Severity
- Critical
- Action
- Immediate escalation
- Sources
- 3 public sources
- Freshness
- Revision 1Oct 23, 20:48 UTC
- Vulnerabilities
- 1 CVE
- Source quality
- B2Very likely
SmarterMail Build 9406 and earlier contains an unauthenticated arbitrary file upload vulnerability (CVE-2025-52691). The vulnerability allows an attacker to upload arbitrary files to any location on the mail server, which can be leveraged to achieve remote code execution. Public exploit code for this vulnerability is actively circulating on platforms such as GitHub and KitPloit.
Impact
Successful exploitation allows an unauthenticated attacker to gain remote code execution on the mail server with high privileges (CVSS 10.0).
Recommendation
- Upgrade SmarterMail to Build 9413 or later immediately to remediate CVE-2025-52691.
- Audit web server access logs for anomalous POST requests directed at SmarterMail file upload endpoints.
- Restrict internet exposure of SmarterMail management interfaces where possible.
Immediate actions
Patch SmarterMail to version 100.0.9413 or later.
Threat Hunt
Identify unauthorized file uploads or abnormal file creation events in SmarterMail application directories.
Data: Web server access logs, File system modification logs (FIM)
Mitigations
Upgrade to SmarterMail Build 100.0.9413.
CVE-2025-52691