The Cyber Safety Company of Singapore (CSA) has issued a bulletin warning of a maximum-severity security flaw in SmarterTools SmarterMail electronic mail software program that may very well be exploited to attain distant code execution.
The vulnerability, tracked as CVE-2025-52691, carries a CVSS rating of 10.0. It pertains to a case of arbitrary file add that might allow code execution with out requiring any authentication.
“Profitable exploitation of the vulnerability may enable an unauthenticated attacker to add arbitrary recordsdata to any location on the mail server, doubtlessly enabling distant code execution,” CSA mentioned.
Vulnerabilities of this sort enable the add of harmful file varieties which can be routinely processed inside an software’s atmosphere. This might pave the best way for code execution if the uploaded file is interpreted and executed as code, as is the case with PHP recordsdata.
In a hypothetical assault situation, a nasty actor may weaponize this vulnerability to put malicious binaries or net shells that may very well be executed with the identical privileges because the SmarterMail service.
SmarterMail is an alternative choice to enterprise collaboration options like Microsoft Alternate, providing options like safe electronic mail, shared calendars, and immediate messaging. In accordance with data listed on the web site, it is utilized by hosting suppliers like ASPnix Net Internet hosting, Hostek, and simplehosting.ch.
CVE-2025-52691 impacts SmarterMail variations Construct 9406 and earlier. It has been addressed in Construct 9413, which was launched on October 9, 2025.
CSA credited Chua Meng Han from the Centre for Strategic Infocomm Applied sciences (CSIT) for locating and reporting the vulnerability.
Whereas the advisory makes no point out of the flaw being exploited within the wild, customers are suggested to replace to the newest model (Construct 9483, launched on December 18, 2025) for optimum safety.
