Back to Database
Status published
Critical
CVE-2025-52691
Upload Arbitrary Files
Vulnerability Description
Successful exploitation of the vulnerability could allow an unauthenticated attacker to upload arbitrary files to any location on the mail server, potentially enabling remote code execution.
Impact Analysis
Refer to official advisory for detailed impact metrics.
Remediation
Ensure systems are updated to the latest vendor-supplied patch levels.
THREAT MONITOR
Am I Vulnerable?
Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2025-52691
Credits & Attribution
The following person or organization is credited with identifying this vulnerability, as recorded in the NVD database:
- Chua Meng Han
More from SmarterTools
View All →CVE-2022-24387
File upload and overwrite to app_data/Config in SmarterTrack v100.0.8019.14010
Critical
9.1
CVE-2022-24386
Stored XSS in SmarterTrack v100.0.8019.14010
High
8.8
CVE-2022-24385
Information disclosure via direct object access on SmarterTrack v100.0.8019.14010
Medium
6.5
CVE-2022-24384
Reflective XSS on SmarterTrack v100.0.8019.14010
High
8.8
Affected Vendor
SmarterTools
View all reports →Affected Software
SmarterMail
Vulnerable Versions:
SmarterMail versions Build 9406 and earlier
Timeline
Official Publish:
December 29th, 2025
Last Modified:
February 26th, 2026
Added to House:
July 22nd, 2026
CVSS Vectors
V3:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Weaknesses (CWE)
No CWE data available
MITRE ATT&CK TTPs
No associated TTPs found for this vulnerability.