CVE-2025-52691

SmarterTools SmarterMail: Unrestricted Upload of File with Dangerous Type

As of , CVE-2025-52691 in SmarterTools SmarterMail is on CISA's list of exploited vulnerabilities: CISA listed it on . Our patch-first group: Patch now.

Exploited
Yes: CISA listed it on 26 January 2026
US federal deadline
16 February 202621 days after CISA listed it. US federal civilian agencies must fix it by then.
Used in ransomware campaigns
KnownCISA changed it from Unknown to Known on 21 April 2026.
EPSS score
0.86Higher than 99% of the CVEs EPSS scores. EPSS estimates the chance of exploitation activity in the next 30 days.
Public exploit
1 Metasploit module
Fix
Vendor advice: www.csa.gov.sg and www.smartertools.comLinks below, from CISA's entry.

What CISA says to do

Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

CISA's required action

What the flaw is

SmarterTools SmarterMail contains an unrestricted upload of file with dangerous type vulnerability that could allow an unauthenticated attacker to upload arbitrary files to any location on the mail server, potentially enabling remote code execution.

CISA's description

Successful exploitation of the vulnerability could allow an unauthenticated attacker to upload arbitrary files to any location on the mail server, potentially enabling remote code execution.

The CVE record's description, from CSA

CVE published
29 December 2025
Assigned by
CSA
CVSS
10.0 Critical (CVSS 3.1, from the CNA)
CWE-434
Unrestricted Upload of File with Dangerous Type
CISA SSVC, exploitation
active
CISA SSVC, automatable
yes
CISA SSVC, technical impact
total

Timeline

  1. The CVE record was published.
  2. CISA added it to its list of exploited vulnerabilities.
  3. The US federal deadline to fix it.
  4. CISA changed its entry. Ransomware use: Unknown to Known.

Public exploits

Facts from Metasploit's module list and Exploit-DB's index; we never copy exploit code.

  • Metasploit: SmarterTools SmarterMail GUID File Upload Vulnerabilityexploit module, rank excellent

SmarterMail: other exploited entries

VulnerabilityProductOur groupListedDeadlineEPSS
CVE-2026-24423Missing Authentication for Critical FunctionSmarterTools SmarterMailPatch nowRansomware use, listed within a year0.88
CVE-2026-23760Authentication Bypass Using an Alternate Path or ChannelSmarterTools SmarterMailPatch nowRansomware use, listed within a year0.97

Read further