The Cyber Safety Company of Singapore (CSA) has issued a bulletin warning of a maximum-severity safety flaw in SmarterTools SmarterMail electronic mail software program that might be exploited to attain distant code execution.
The vulnerability, tracked as CVE-2025-52691, carries a CVSS rating of 10.0. It pertains to a case of arbitrary file add that might allow code execution with out requiring any authentication.
“Profitable exploitation of the vulnerability may enable an unauthenticated attacker to add arbitrary information to any location on the mail server, probably enabling distant code execution,” CSA mentioned.
Vulnerabilities of this sort enable the add of harmful file sorts which can be routinely processed inside an utility’s atmosphere. This might pave the way in which for code execution if the uploaded file is interpreted and executed as code, as is the case with PHP information.
In a hypothetical assault situation, a foul actor may weaponize this vulnerability to position malicious binaries or net shells that might be executed with the identical privileges because the SmarterMail service.
SmarterMail is a substitute for enterprise collaboration options like Microsoft Change, providing options like safe electronic mail, shared calendars, and immediate messaging. In line with data listed on the web site, it is utilized by website hosting suppliers like ASPnix Internet Internet hosting, Hostek, and simplehosting.ch.
CVE-2025-52691 impacts SmarterMail variations Construct 9406 and earlier. It has been addressed in Construct 9413, which was launched on October 9, 2025.
CSA credited Chua Meng Han from the Centre for Strategic Infocomm Applied sciences (CSIT) for locating and reporting the vulnerability.
Whereas the advisory makes no point out of the flaw being exploited within the wild, customers are suggested to replace to the newest model (Construct 9483, launched on December 18, 2025) for optimum safety.
