CVE-2025-52691
Published: 29 December 2025
Summary
CVE-2025-52691 is a critical-severity Unrestricted Upload of File with Dangerous Type (CWE-434) vulnerability in Smartertools Smartermail. Its CVSS base score is 10.0 (Critical).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 0.3% of CVEs by exploit likelihood; CISA has added it to the Known Exploited Vulnerabilities catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Deeper analysis
CVE-2025-52691 is a critical vulnerability (CVSS 10.0, CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H) affecting SmarterMail, a mail server software. It stems from CWE-434 (Unrestricted Upload of File with Dangerous Type), where successful exploitation allows an unauthenticated attacker to upload arbitrary files to any location on the server, potentially leading to remote code execution. The vulnerability was published on 2025-12-29.
An unauthenticated attacker with network access can exploit this vulnerability with low complexity and no user interaction required. By uploading malicious files to arbitrary server locations, the attacker can achieve high confidentiality, integrity, and availability impacts, including full remote code execution in a scoped manner.
Advisories from the Cyber Security Agency of Singapore (CSA) at https://www.csa.gov.sg/alerts-and-advisories/alerts/al-2025-124/, WatchTowr Labs GitHub analysis at https://github.com/watchtowrlabs/watchTowr-vs-SmarterMail-CVE-2025-52691?ref=labs.watchtowr.com, and CISA's Known Exploited Vulnerabilities Catalog at https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-52691 provide further details on exploitation and mitigation recommendations.
This vulnerability is listed in CISA's Known Exploited Vulnerabilities Catalog, indicating active real-world exploitation.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-205544
Vulnerability details
Successful exploitation of the vulnerability could allow an unauthenticated attacker to upload arbitrary files to any location on the mail server, potentially enabling remote code execution.
- CWE(s)
- KEV Date Added
- 26 January 2026
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Unauthenticated arbitrary file upload to any location on public-facing SmarterMail mail server enables remote code execution, directly mapping to T1190: Exploit Public-Facing Application.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly mandates timely identification, reporting, and patching of critical flaws like this unrestricted file upload vulnerability in SmarterMail to prevent exploitation.
Requires information input validation at upload points to restrict dangerous file types and arbitrary placements, directly countering CWE-434 unrestricted uploads.
Deploys malicious code protection mechanisms to scan for and block execution of arbitrarily uploaded files leading to remote code execution.