Dec 30, 2026Ravie LakshmananVulnerability / E-mail Safety
The Cyber Safety Company of Singapore (CSA) has issued a bulletin warning of a maximum-severity safety flaw in SmarterTools SmarterMail e-mail software program that may very well be exploited to realize distant code execution.
The vulnerability, tracked as CVE-2025-52691, carries a CVSS rating of 10.0. It pertains to a case of arbitrary file add that would allow code execution with out requiring any authentication.
“Profitable exploitation of the vulnerability may permit an unauthenticated attacker to add arbitrary information to any location on the mail server, doubtlessly enabling distant code execution,” CSA mentioned.
Vulnerabilities of this sort permit the add of harmful file varieties which can be robotically processed inside an utility’s atmosphere. This might pave the way in which for code execution if the uploaded file is interpreted and executed as code, as is the case with PHP information.
In a hypothetical assault state of affairs, a foul actor may weaponize this vulnerability to position malicious binaries or net shells that may very well be executed with the identical privileges because the SmarterMail service.
SmarterMail is a substitute for enterprise collaboration options like Microsoft Alternate, providing options like safe e-mail, shared calendars, and on the spot messaging. In keeping with info listed on the web site, it is utilized by hosting suppliers like ASPnix Internet Internet hosting, Hostek, and simplehosting.ch.
CVE-2025-52691 impacts SmarterMail variations Construct 9406 and earlier. It has been addressed in Construct 9413, which was launched on October 9, 2025.
CSA credited Chua Meng Han from the Centre for Strategic Infocomm Applied sciences (CSIT) for locating and reporting the vulnerability.
Whereas the advisory makes no point out of the flaw being exploited within the wild, customers are suggested to replace to the newest model (Construct 9483, launched on December 18, 2025) for optimum safety.
