File Upload vulnerability affecting SmarterMail
A critical vulnerability affecting SmarterMail would allow a malicious actor to upload arbitrary files to affected systems.
Description
Technical context and vulnerability details
SmarterMail is a mail server solution and collaboration platform that allows you to manage emails, calendars and contacts. It is commonly used in professional environments and offers access via a web interface. This solution is affected by a critical vulnerability labeled CVE‑2025‑52691, resulting from insufficient control of uploaded files. Exploitation of this vulnerability would allow an unauthenticated malicious actor to unrestrictedly upload arbitrary files to target systems. It is classified critical with a severity score of 10 according to CVSS V3.1.
Potential Risks & Impact
Potential consequences upon exploitation
- Executing arbitrary scripts;
- Compromise of system integrity;
- Data privacy breach;
Affected systems
Products, components and targeted versions
- All versions of SmarterMail prior to and including Build 9406;
Recommended Remediations & Actions
Immediate actions and recommended mitigations
- Update SmarterMail to Build 9413;
Sources & External Links
Vendor security advisories and documentation
Advisory Specifications
CSIRT Emergency Response
Is your organization affected or do you suspect an incident? Our security experts are available to assist.
Report an incidentGet our alerts by email
Subscribe to receive our security alert bulletins and Iservices news straight to your inbox.