CSA Points Alert on Important SmarterMail Bug Permitting Distant Code Execution

Dec 30, 2026Ravie LakshmananVulnerability / Electronic mail Safety

The Cyber Safety Company of Singapore (CSA) has issued a bulletin warning of a maximum-severity safety flaw in SmarterTools SmarterMail electronic mail software program that could possibly be exploited to realize distant code execution.

The vulnerability, tracked as CVE-2025-52691, carries a CVSS rating of 10.0. It pertains to a case of arbitrary file add that might allow code execution with out requiring any authentication.

“Profitable exploitation of the vulnerability may permit an unauthenticated attacker to add arbitrary recordsdata to any location on the mail server, doubtlessly enabling distant code execution,” CSA mentioned.

Vulnerabilities of this sort permit the add of harmful file varieties which might be robotically processed inside an software’s setting. This might pave the best way for code execution if the uploaded file is interpreted and executed as code, as is the case with PHP recordsdata.

In a hypothetical assault situation, a foul actor may weaponize this vulnerability to position malicious binaries or internet shells that could possibly be executed with the identical privileges because the SmarterMail service.

SmarterMail is an alternative choice to enterprise collaboration options like Microsoft Change, providing options like safe electronic mail, shared calendars, and immediate messaging. In line with data listed on the web site, it is utilized by webhosting suppliers like ASPnix Internet Internet hosting, Hostek, and simplehosting.ch.

CVE-2025-52691 impacts SmarterMail variations Construct 9406 and earlier. It has been addressed in Construct 9413, which was launched on October 9, 2025.

CSA credited Chua Meng Han from the Centre for Strategic Infocomm Applied sciences (CSIT) for locating and reporting the vulnerability.

Whereas the advisory makes no point out of the flaw being exploited within the wild, customers are suggested to replace to the most recent model (Construct 9483, launched on December 18, 2025) for optimum safety.