CSA Issues Alert on Critical SmarterMail Bug Allowing Remote Code Execution

The Cyber Security Agency of Singapore (CSA) has issued a bulletin warning of a maximum-severity security flaw in SmarterTools SmarterMail email software that could be exploited to achieve remote code execution.

The vulnerability, tracked as CVE-2025-52691, carries a CVSS score of 10.0. It relates to a case of arbitrary file upload that could enable code execution without requiring any authentication.

✔ Approved From Our Partners

Protect and backup your data using AOMEI Backupper. AOMEI Backupper takes secure and encrypted backups from your Windows, hard drives or partitions. With AOMEI Backupper you will never be worried about loosing your data anymore.

Get AOMEI Backupper with 72% discount from an authorized distrinutor of AOMEI: SerialCart® (Limited Offer).

➤ Activate Your Coupon Code

“Successful exploitation of the vulnerability could allow an unauthenticated attacker to upload arbitrary files to any location on the mail server, potentially enabling remote code execution,” CSA said.

Vulnerabilities of this kind allow the upload of dangerous file types that are automatically processed within an application’s environment. This could pave the way for code execution if the uploaded file is interpreted and executed as code, as is the case with PHP files.

In a hypothetical attack scenario, a bad actor could weaponize this vulnerability to place malicious binaries or web shells that could be executed with the same privileges as the SmarterMail service.

SmarterMail is an alternative to enterprise collaboration solutions like Microsoft Exchange, offering features like secure email, shared calendars, and instant messaging. According to information listed on the website, it’s used by web hosting providers like ASPnix Web Hosting, Hostek, and simplehosting.ch.

CVE-2025-52691 impacts SmarterMail versions Build 9406 and earlier. It has been addressed in Build 9413, which was released on October 9, 2025.

CSA credited Chua Meng Han from the Centre for Strategic Infocomm Technologies (CSIT) for discovering and reporting the vulnerability.

While the advisory makes no mention of the flaw being exploited in the wild, users are advised to update to the latest version (Build 9483, released on December 18, 2025) for optimal protection.

Found this article interesting? Follow us on Google News, Twitter and LinkedIn to read more exclusive content we post.