CVE-2025-52691

The vulnerability (CWE-434 — unrestricted upload of file with dangerous type) allows an unauthenticated attacker to upload a file of any type to a selected location on the server. The lack of user identity verification and lack of control over the type and destination of the uploaded file means that an attacker can place, for example, a webshell or other malicious executable code directly on the server. Then the attacker can call the uploaded file remotely, gaining full control of the mail server environment.

An attacker can obtain the ability to remotely execute arbitrary code (RCE) on the mail server without any authentication, which means complete takeover of the system, access to stored email messages, and potential ability to perform lateral movement within the internal network.

Apply patches available from the vendor (SmarterTools) immediately according to the references. Due to active exploitation of the vulnerability in production environments (CISA KEV), the update should be performed immediately. Until the patch is deployed, it is recommended to restrict network access to SmarterMail interfaces and increase monitoring of server logs for suspicious file upload operations.

SmarterMail product by SmarterTools — versions indicated in the vendor references and in the watchTowr Labs analysis (GitHub reference).

Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

SmarterTools SmarterMail contains an unrestricted upload of file with dangerous type vulnerability that could allow an unauthenticated attacker to upload arbitrary files to any location on the mail server, potentially enabling remote code execution.