CSA Issues Alert on Critical SmarterMail Bug Allowing Remote Code Execution
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2025-52691 | Unauthenticated Arbitrary File Upload RCE in SmarterTools SmarterMail SmarterTools SmarterMail contains an unrestricted file upload flaw (CWE-434, CVSS 10.0) that lets an unauthenticated attacker upload files of dangerous types over the network without any credentials or user interaction. Because the uploaded files can be written to any location on the mail server, an attacker can drop a file into an executable path and achieve remote code execution on the host, which is why the CVSS scope is changed with high confidentiality, integrity and availability impact. An attacker who lands this foothold gains control of the mail server, and CISA notes known ransomware use, with press coverage linking the wave of SmarterMail exploitation to groups such as Storm-1175 and Warlock. Any organization running an internet-facing SmarterMail server — typically hosting providers, MSPs and SMBs using it as a Windows mail platform — is exposed. Exploitation is active: the flaw was added to CISA's Known Exploited Vulnerabilities catalog on 2026-01-26, EPSS puts the 30-day exploitation probability at 85.7% (100th percentile), and a public proof-of-concept exploit is available from watchTowr. Do: Upgrade SmarterMail to the patched build referenced in the vendor advisory (exact build number not provided in the source data), prioritizing internet-exposed servers, and note that news reports indicate exploit activity began within roughly two days of the patch release, so unpatched systems should be assumed targeted. Check servers for signs of compromise — unexpected files in web-accessible or executable paths, new admin accounts, webshells, and ransomware indicators — and restrict webmail endpoints to trusted networks if immediate patching is not possible. US federal agencies must apply the required mitigation or discontinue use under BOD 22-01 timelines. | 10.0 | 86% | KEV ransomware PoC |
| moderateseveral thousand internet-exposed SmarterMail servers (niche Windows mail server with a total install base in the low tens of thousands) |
Full article544 words · extracted from thehackernews.com · click to collapse
Ravie LakshmananDec 30, 2025Vulnerability / Email Security
The Cyber Security Agency of Singapore (CSA) has issued a bulletin warning of a maximum-severity security flaw in SmarterTools SmarterMail email software that could be exploited to achieve remote code execution.
The vulnerability, tracked as CVE-2025-52691, carries a CVSS score of 10.0. It relates to a case of arbitrary file upload that could enable code execution without requiring any authentication.
"Successful exploitation of the vulnerability could allow an unauthenticated attacker to upload arbitrary files to any location on the mail server, potentially enabling remote code execution," CSA said.
Vulnerabilities of this kind allow the upload of dangerous file types that are automatically processed within an application's environment. This could pave the way for code execution if the uploaded file is interpreted and executed as code, as is the case with PHP files.
In a hypothetical attack scenario, a bad actor could weaponize this vulnerability to place malicious binaries or web shells that could be executed with the same privileges as the SmarterMail service.
SmarterMail is an alternative to enterprise collaboration solutions like Microsoft Exchange, offering features like secure email, shared calendars, and instant messaging. According to information listed on the website, it's used by web hosting providers like ASPnix Web Hosting, Hostek, and simplehosting.ch.
CVE-2025-52691 impacts SmarterMail versions Build 9406 and earlier. It has been addressed in Build 9413, which was released on October 9, 2025.
CSA credited Chua Meng Han from the Centre for Strategic Infocomm Technologies (CSIT) for discovering and reporting the vulnerability.
While the advisory makes no mention of the flaw being exploited in the wild, users are advised to update to the latest version (Build 9483, released on December 18, 2025) for optimal protection.
Update
Attack surface management platform Censys said it's observing nearly 16,000 internet-exposed hosts that are potentially vulnerable to the flaw. Of these, more than 12,500 instances are located in the U.S., followed by Malaysia (784), Iran (348), India (321), the U.K. (292), and Germany (205).
Update
In a technical analysis published on January 8, 2026, watchTowr said the problem is rooted in an API controller named "SmarterMail.Web.Api.FileUploadController.Upload()" that's registered to the "/api/upload" route. This API, in turn, enables the upload of ICS files, attachments, and notes.
Further analysis has determined that it's possible to send a specially crafted request to the "api/upload" endpoint with the Content-Type header set to "multipart/form-data" to upload a file and achieve a full unauthenticated file write on SmarterMail by taking advantage of the fact that a parameter named GUID is susceptible to path traversal.
As a result, an attacker can send an HTTP request with the GUID parameter set to a specific value (e.g., "dag/../../../../../../../../../../../../../../../inetpub/wwwroot/watchTowr") to upload a web shell to the instance and obtain code execution.
"As an aside, it seems that SmarterMail scans all the attachments with ClamAV," researchers Piotr Bazydlo and Sina Kheirkhah said. "However, either ClamAV is unable to recognize a basic webshell payload (possible), or SmarterMail is unable to process ClamAV results."
(The story was updated after publication on January 9, 2026, to include additional technical details of the flaw from watchTowr.)
Found this article interesting? Follow us on Google News, Twitter and LinkedIn to read more exclusive content we post.
Text extracted automatically; images, tables and formatting may be missing. Original: https://thehackernews.com/2025/12/csa-issues-alert-on-critical.html