CVE-2025-52691

UNKNOWNKnown Exploited

CISA Known Exploited Vulnerability

https://www.smartertools.com/smartermail/release-notes/current ; https://www.csa.gov.sg/alerts-and-advisories/alerts/al-2025-124/ ; https://nvd.nist.gov/vuln/detail/CVE-2025-52691

Remediation deadline: February 16, 2026

Ransomware use: Known

Description

SmarterTools SmarterMail contains an unrestricted upload of file with dangerous type vulnerability that could allow an unauthenticated attacker to upload arbitrary files to any location on the mail server, potentially enabling remote code execution.

Timeline

Published:January 26th, 2026 12:00 AM

Last modified:January 26th, 2026 12:00 AM

Added to KEV:January 26th, 2026

CVSS Scoring

No CVSS v3 score available

Affected Software

From NVD CPE configuration data

Vendors

SmarterTools

Products

SmarterMail

Weaknesses (CWE)

CWE-434

References & Reports

Advisories, patches, and third-party reports

No references available.

Source: CISA KEV + NVD · Data may lag official sources by up to one minute