{"id":"CVE-2025-52691","published":"2025-12-29T03:15:42Z","modified":"2026-10-07T12:10:00Z","title":"SmarterTools SmarterMail Unrestricted Upload of File with Dangerous Type Vulnerability","vendor":"SmarterTools","product":"SmarterMail","tier":"core","eol":null,"description":{"text":"Successful exploitation of the vulnerability could allow an unauthenticated attacker to upload arbitrary files to any location on the mail server, potentially enabling remote code execution.","provenance":"source","from":"NVD"},"summary":{"text":"The flaw is an unrestricted file upload vulnerability in SmarterTools SmarterMail, which allows dangerous file types to be accepted by the product's upload handling. An unauthenticated attacker with network access can upload arbitrary files to any location on the mail server without user interaction, potentially enabling remote code execution.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-23T06:54:54Z"},"cvss":{"score":10.0,"severity":"CRITICAL","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","provenance":"source","from":"NVD"},"epss":{"score":0.85655,"percentile":0.99725,"date":"2026-10-29","provenance":"source"},"kev":{"dateAdded":"2026-01-26","dueDate":"2026-02-16","ransomware":true,"requiredAction":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","notes":"https://www.smartertools.com/smartermail/release-notes/current ; https://www.csa.gov.sg/alerts-and-advisories/alerts/al-2025-124/ ; https://nvd.nist.gov/vuln/detail/CVE-2025-52691","provenance":"source"},"vulncheckKev":{"dateAdded":"2026-01-22","exploitedFirstSeen":"2026-01-22","ransomware":true,"evidence":[{"url":"https://labs.watchtowr.com/attackers-with-decompilers-strike-again-smartertools-smartermail-wt-2026-0001-auth-bypass/","date":"2026-01-22"},{"url":"https://www.huntress.com/blog/smartermail-account-takeover-leading-to-rce","date":"2026-01-22"},{"url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","date":"2026-01-26"},{"url":"https://fortiguard.fortinet.com/outbreak-alert/smartertools-smartermail-rce","date":"2026-01-29"},{"url":"https://www.recordedfuture.com/blog/january-2026-cve-landscape","date":"2026-02-24"},{"url":"https://ctrlaltintel.com/threat%20research/MuddyWater/","date":"2026-03-04"},{"url":"https://www.rapid7.com/blog/post/tr-detection-coverage-iran-linked-cyber-activity/","date":"2026-03-11"},{"url":"https://fortiguard.fortinet.com/outbreak-alert/iran-linked-cyber-attacks","date":"2026-03-31"},{"url":"https://www.microsoft.com/en-us/security/blog/2026/04/06/storm-1175-focuses-gaze-on-vulnerable-web-facing-assets-in-high-tempo-medusa-ransomware-operations/","date":"2026-04-06"},{"url":"https://cyble.com/reports/H1-2026-Global-Threat-Landscape-Report.pdf","date":"2026-07-27"}],"evidenceTotal":10,"provenance":"source"},"exploited":true,"otx":{"pulseCount":50,"pulses":[{"name":"Actively_Exploited_Kev | Oct 30, 2026","url":"https://otx.alienvault.com/pulse/6ae35d889ea92b4ce19c2680","created":"2026-10-29"},{"name":"Actively_Exploited_Kev | Oct 29, 2026","url":"https://otx.alienvault.com/pulse/6ae20c1db17e7057ae7d9ad1","created":"2026-10-28"},{"name":"Actively_Exploited_Kev | Oct 28, 2026","url":"https://otx.alienvault.com/pulse/6ae0ba7e0e2a97ff7b218819","created":"2026-10-27"},{"name":"Actively_Exploited_Kev | Oct 27, 2026","url":"https://otx.alienvault.com/pulse/6adf68b85c3e852f3c111d18","created":"2026-10-26"},{"name":"Actively_Exploited_Kev | Oct 24, 2026","url":"https://otx.alienvault.com/pulse/6adb740e397c3ad4799aa4cd","created":"2026-10-23"},{"name":"Actively_Exploited_Kev | Oct 23, 2026","url":"https://otx.alienvault.com/pulse/6ada236fcfba2dfa730ea482","created":"2026-10-22"},{"name":"Actively_Exploited_Kev | Oct 22, 2026","url":"https://otx.alienvault.com/pulse/6ad8d33a077cbb5cab524d80","created":"2026-10-21"},{"name":"Actively_Exploited_Kev | Oct 21, 2026","url":"https://otx.alienvault.com/pulse/6ad78130c4d1ac2be83a8b6d","created":"2026-10-20"},{"name":"Actively_Exploited_Kev | Oct 20, 2026","url":"https://otx.alienvault.com/pulse/6ad62f63c24a405a3423cc13","created":"2026-10-19"},{"name":"Actively_Exploited_Kev | Oct 19, 2026","url":"https://otx.alienvault.com/pulse/6ad4dda174e5797d0bd238b7","created":"2026-10-18"}],"provenance":"machine"},"cwes":[{"id":"CWE-434","name":"Unrestricted Upload of File with Dangerous Type"}],"references":[{"url":"https://www.csa.gov.sg/alerts-and-advisories/alerts/al-2025-124/","tags":["Third Party Advisory"]},{"url":"https://github.com/watchtowrlabs/watchTowr-vs-SmarterMail-CVE-2025-52691?ref=labs.watchtowr.com","tags":["Exploit","Third Party Advisory"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-52691","tags":["US Government Resource"]}],"techniques":[{"id":"T1190","name":"Exploit Public-Facing Application","tactics":["initial-access"],"provenance":"ai","basis":"ai-mapping","bases":["ai-mapping"],"basisDetail":"claude-haiku-5-5: Unauthenticated upload via exposed mail server web interface","mappingType":"exploitation_technique","evidence":[{"from":"description","quote":"allow an unauthenticated attacker to upload arbitrary files","start":51,"end":110}],"model":"claude-haiku-5-5","confidence":"medium","confidenceNote":"AI-mapped from the description (quote-validated, not expert-reviewed)"},{"id":"T1059","name":"Command and Scripting Interpreter","tactics":["execution"],"provenance":"ai","basis":"ai-mapping","bases":["ai-mapping"],"basisDetail":"claude-haiku-5-5: Uploaded files yield arbitrary code execution","mappingType":"primary_impact","evidence":[{"from":"description","quote":"potentially enabling remote code execution","start":147,"end":189}],"model":"claude-haiku-5-5","confidence":"medium","confidenceNote":"AI-mapped from the description (quote-validated, not expert-reviewed)"},{"id":"T1505.003","name":"Web Shell","tactics":["persistence"],"provenance":"ai","basis":"ai-mapping","bases":["ai-mapping"],"basisDetail":"claude-haiku-5-5: Uploaded web shell enables persistent server access","mappingType":"primary_impact","evidence":[{"from":"description","quote":"upload arbitrary files to any location on the mail server","start":88,"end":145}],"model":"claude-haiku-5-5","confidence":"medium","confidenceNote":"AI-mapped from the description (quote-validated, not expert-reviewed)"}],"reports":[{"id":"SRC-6456fe61781512dde412","title":"MuddyWater Exposed: Inside an Iranian APT operation - Ctrl-Alt-Intel","publisher":"ctrlaltintel.com","url":"https://ctrlaltintel.com/research/MuddyWater/","date":"2026-03-04","mentions":[{"quote":"CVE-2025-52691 - SmarterTools SmarterMail unrestricted file upload","start":4146,"end":4212}]}],"affected":[],"advisories":[],"euvd":{"id":"EUVD-2025-205544","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2025-205544","exploited":true,"exploitedSince":"2026-01-26","provenance":"source"},"exploits":[],"exploitSources":{"pocGithub":{"count":7,"skipped":1,"earliest":"2025-12-30","earliestUrl":"https://github.com/rxerium/CVE-2025-52691","repos":[{"name":"rxerium/CVE-2025-52691","url":"https://github.com/rxerium/CVE-2025-52691","stars":19,"created":"2025-12-30"},{"name":"watchtowrlabs/watchTowr-vs-SmarterMail-CVE-2025-52691","url":"https://github.com/watchtowrlabs/watchTowr-vs-SmarterMail-CVE-2025-52691","stars":19,"created":"2026-01-08"},{"name":"DeathShotXD/CVE-2025-52691-APT-PoC","url":"https://github.com/DeathShotXD/CVE-2025-52691-APT-PoC","stars":5,"created":"2025-12-30"},{"name":"rimbadirgantara/CVE-2025-52691-poc","url":"https://github.com/rimbadirgantara/CVE-2025-52691-poc","stars":3,"created":"2026-01-11"},{"name":"you-ssef9/CVE-2025-52691","url":"https://github.com/you-ssef9/CVE-2025-52691","stars":1,"created":"2025-12-30"}]},"metasploit":[{"name":"SmarterTools SmarterMail GUID File Upload Vulnerability","module":"exploit/multi/http/smartermail_guid_file_upload","type":"exploit","disclosureDate":"2025-10-09","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/http/smartermail_guid_file_upload.rb"}],"nuclei":[{"id":"CVE-2025-52691","name":"SmarterMail - Unrestricted File Upload","severity":"critical","path":"http/cves/2025/CVE-2025-52691.yaml","url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-52691.yaml"}],"first":{"date":"2025-10-09","source":"Metasploit","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/http/smartermail_guid_file_upload.rb"},"provenance":"source"},"exploitRefs":["https://github.com/watchtowrlabs/watchTowr-vs-SmarterMail-CVE-2025-52691?ref=labs.watchtowr.com"],"flow":[{"stage":"exploitation","techniques":["T1190"],"provenance":"ai"},{"stage":"primary","techniques":["T1059","T1505.003"],"provenance":"ai"}],"timeline":[{"date":"2025-10-09","kind":"exploit-public","label":"First public exploit: Metasploit; later: PoC-in-GitHub 2025-12-30","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/http/smartermail_guid_file_upload.rb","provenance":"source"},{"date":"2025-12-29","kind":"published","label":"Published (NVD)","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-52691","provenance":"source"},{"date":"2026-01-22","kind":"exploited-reported","label":"Exploitation first reported (VulnCheck KEV evidence)","url":"https://labs.watchtowr.com/attackers-with-decompilers-strike-again-smartertools-smartermail-wt-2026-0001-auth-bypass/","provenance":"source"},{"date":"2026-01-26","kind":"kev","label":"Added to CISA KEV (known ransomware use)","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","provenance":"source"},{"date":"2026-01-26","kind":"euvd-exploited","label":"ENISA EUVD: exploited","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2025-205544","provenance":"source"},{"date":"2026-03-04","kind":"report","label":"Named in ctrlaltintel.com: MuddyWater Exposed: Inside an Iranian APT operation - Ctrl-Alt-Intel","url":"https://ctrlaltintel.com/research/MuddyWater/","provenance":"machine"}],"speed":{"daysToPublicExploit":null,"firstExploitFrom":"Metasploit","daysToKev":28},"priority":{"score":88.8,"factors":[{"name":"In a KEV catalog","points":35.0,"detail":"listed in CISA KEV and VulnCheck KEV"},{"name":"Recent KEV listing","points":5.0,"detail":"added 281 days ago"},{"name":"Known ransomware use","points":10.0,"detail":"CISA KEV and VulnCheck KEV: Known"},{"name":"EPSS percentile","points":19.95,"detail":"percentile 0.9972"},{"name":"Named in threat reports","points":3.87,"detail":"1 report"},{"name":"Public exploit code","points":5.0,"detail":"1 NVD reference tagged Exploit; 7 PoC-in-GitHub repos; 1 Metasploit module; 1 nuclei template"},{"name":"Mentioned in OTX pulses","points":3.0,"detail":"50 pulses"},{"name":"CVSS severity","points":7.0,"detail":"base score 10.0"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]}}