Veille CVE
CVE-2025-52691
10.0 Critique Exploitée activement Utilisée par des rançongicielsCatalogue CISA KEV — SmarterTools SmarterMail Unrestricted Upload of File with Dangerous Type Vulnerability
Ajoutée le 26/01/2026 · Échéance de correction (agences US) : 16/02/2026
Action requise : Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Description
Successful exploitation of the vulnerability could allow an unauthenticated attacker to upload arbitrary files to any location on the mail server, potentially enabling remote code execution.
Produits concernés
Scores CVSS
| Version | Score | Source | Vecteur |
|---|---|---|---|
| 3.1 | 10.0 Critique | 5f57b9bf-260d-4433-bf07-b6a79e9bb7d4 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H |
Faiblesses (CWE)
Références
- https://www.csa.gov.sg/alerts-and-advisories/alerts/al-2025-124/ Third Party Advisory
- https://github.com/watchtowrlabs/watchTowr-vs-SmarterMail-CVE-2025-52691?ref=labs.watchtowr.com ExploitThird Party Advisory
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-52691 US Government Resource