How severe is CVE-2025-52691?

CVE-2025-52691 has a CVSS 3.1 base score of 10 (CRITICAL). EPSS estimates a 85.7% probability of exploitation in the next 30 days. It is listed in the CISA Known Exploited Vulnerabilities catalog.

CVE-2025-52691: Upload Arbitrary

CISA Known Exploited Vulnerabilities

SmarterTools SmarterMail Unrestricted Upload of File with Dangerous Type Vulnerability is confirmed as actively exploited and is listed in the CISA KEV catalog.

Added to KEV

2026-01-26

Remediation due

2026-02-16

Ransomware

Known use

Required action
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

CISA notes
https://www.smartertools.com/smartermail/release-notes/current ; https://www.csa.gov.sg/alerts-and-advisories/alerts/al-2025-124/ ; https://nvd.nist.gov/vuln/detail/CVE-2025-52691

Description

Successful exploitation of the vulnerability could allow an unauthenticated attacker to upload arbitrary files to any location on the mail server, potentially enabling remote code execution.

Severity

CVSS 3.1 · CNA10 CRITICAL

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

SSVC · CISA-ADP

Exploitationactive

Automatableyes

Technical impacttotal

Affected Products

Vendor	Product	Affected versions
SmarterTools	SmarterMail	SmarterMail versions Build 9406 and earlier

References

1 Links

Other references

https://www.csa.gov.sg/alerts-and-advisories/alerts/al-2025-124/

Record Details

Published

2025-12-29

Last updated

2026-02-26

Assigner (CNA)

CSA

Credited to

Chua Meng Han

More from SmarterTools

CVE-2026-237609.3

SmarterTools SmarterMail < Build 9511 Authentication Bypass via Password Reset API

CVE-2026-244239.3

SmarterTools SmarterMail < Build 9511 Unauthenticated RCE via ConnectToHub API

CVE record data © The MITRE Corporation, used under the CVE Terms of Use. Exploited-in-the-wild data from the CISA Known Exploited Vulnerabilities catalog (CC0). Exploit prediction scores by FIRST EPSS (first.org/epss). This site is not endorsed or certified by MITRE, NVD, CISA, or FIRST.