SmarterMail (< 100.0.9413) - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/products/smartermail--100.0.9413/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioFri, 23 Oct 2026 20:48:03 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgSmarterTools SmarterMail: Unauthenticated remote code execution (CVE-2025-52691)https://feed.craftedsignal.io/briefs/2026-10-smartermail-rce/Fri, 23 Oct 2026 20:48:03 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-10-smartermail-rce/CVE-2025-52691 is a critical arbitrary file upload vulnerability in SmarterMail (Build 9406 and earlier) that enables unauthenticated remote code execution, with multiple proof-of-concept exploits publicly available.SmarterMail Build 9406 and earlier contains an unauthenticated arbitrary file upload vulnerability (CVE-2025-52691). The vulnerability allows an attacker to upload arbitrary files to any location on the mail server, which can be leveraged to achieve remote code execution. Public exploit code for this vulnerability is actively circulating on platforms such as GitHub and KitPloit.

Impact

Successful exploitation allows an unauthenticated attacker to gain remote code execution on the mail server with high privileges (CVSS 10.0).

Recommendation

  • Upgrade SmarterMail to Build 9413 or later immediately to remediate CVE-2025-52691.
  • Audit web server access logs for anomalous POST requests directed at SmarterMail file upload endpoints.
  • Restrict internet exposure of SmarterMail management interfaces where possible.
]]>criticaladvisoryremote-code-executionfile-uploadvulnerabilitycve