SmarterMail Vulnerability Allows Remote Code Execution, PoC Available

A critical pre-authentication remote code execution vulnerability in SmarterTools’ SmarterMail email server has been disclosed and exploited in the wild, enabling attackers to upload arbitrary files and gain full system access without credentials. 

The flaw combines an unauthenticated file upload endpoint with path traversal in the GUID parameter, allowing attackers to write web shells directly into web-accessible directories. 

CVE ID	Vendor / Product	Vulnerability Type	CVSS Score
CVE-2025-52691	SmarterTools SmarterMail	Pre-auth RCE via path traversal in file upload	10.0 (Critical)​

The Vulnerability

CVE-2025-52691 received a perfect CVSS score of 10.0. Yet SmarterMail silently patched it in build 9413, released on October 10, 2025, nearly three months before the official advisory from Singapore’s Cyber Security Agency (CSA) in late December.  

This creates a dangerous window: attackers can reverse-engineer the patch to identify the vulnerability, then target customers still running unpatched builds, many of whom may not have received the advisory in time.​ 

The vulnerability exploits the unauthenticated /api/upload endpoint, which accepts file uploads via multipart/form-data requests.  

The endpoint deserializes a JSON contextData parameter that contains a guid field used to organize uploaded attachments. However, it is never validated for path traversal sequences.​ 

Set the context parameter to “attachment” to trigger the vulnerable code path. 

Craft a contextData JSON object with a guid value containing path traversal sequences (e.g., “guid”: “dag/../../../../../../../inetpub/wwwroot/shell”). 

Upload a web shell file with an .aspx extension as the resumableFilename. 

The vulnerable GenerateFileName and GenerateFileNameAndLocation methods concatenate the attacker-supplied GUID without validation, causing the file to be written outside the intended App_Data/Attachments directory. 

The shell is written directly to a web-accessible directory (e.g., C:\inetpub\wwwroot\) and becomes executable. 

The entire process requires zero authentication and can be completed in a single HTTP POST request. 

Even though the patch exists in build 9413 (released October 2025), many organizations running earlier builds, particularly in enterprise email infrastructure, where updates lag, remain vulnerable. 

The three-month delay between the silent patch and public disclosure gave sophisticated attackers a significant window to identify and exploit the flaw before defenders could react. 

SmarterMail’s antivirus integration via ClamAV does not appear to prevent the attack, either because the scanning cannot detect simple web shells or because the integration fails to block the upload. 

Organizations running SmarterMail must immediately patch to build 9413 or later.  

According to the WatchTowr, the endpoint should also be monitored for POST requests to /api/upload containing path traversal sequences (../, ..\\) in the contextData parameter, particularly those attempting to reach web directories like inetpub\wwwroot or other web-accessible paths. 

Follow us on Google News, LinkedIn, and X to Get Instant Updates and Set GBH as a Preferred Source in Google.