Back to Database
Status published
Medium
CVE-2025-34490
GFI MailEssentials < 21.8 XXE Arbitrary File Read
Vulnerability Description
GFI MailEssentials prior to version 21.8 is vulnerable to an XML External Entity (XXE) issue. An authenticated and remote attacker can send crafted HTTP requests to read arbitrary system files.
Impact Analysis
Refer to official advisory for detailed impact metrics.
Remediation
Ensure systems are updated to the latest vendor-supplied patch levels.
THREAT MONITOR
Am I Vulnerable?
Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2025-34490
Credits & Attribution
The following person or organization is credited with identifying this vulnerability, as recorded in the NVD database:
- Frycos
References
More from GFI
View All →CVE-2025-35940
Hard-coded ArchiverSpaApi JWT Signing Key
High
8.1
CVE-2025-34491
GFI MailEssentials < 21.8 MultiNode Insecure Deserialization
High
8.8
CVE-2025-34489
GFI MailEssentials < 21.8 Local Privilege Escalation
High
7.8
CVE-2025-2977
GFI KerioConnect PDF File cross site scripting
Medium
5.1
CVE-2025-2976
GFI KerioConnect File Upload cross site scripting
Medium
5.1
Affected Vendor
Affected Software
MailEssentials
Vulnerable Versions:
0
Timeline
Official Publish:
April 28th, 2025
Last Modified:
November 19th, 2025
Added to House:
July 22nd, 2026
CVSS Vectors
V3:
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N