CVE Watch—

CVE-2025-52691

SmarterTools SmarterMail Unrestricted Upload of File with Dangerous Type Vulnerability

CVSS

—

No CVSS

EPSS

85.5%

p100

KEV

YES

Jan 26, 2026

Exploit Today

0-100

Published: — · Last modified: —

EPSS · 30d

85.5%EPSS · 30 days85.5%

2026-06-302026-07-16

KEV catalog record

Product

SmarterTools / SmarterMail

Vulnerability

SmarterTools SmarterMail Unrestricted Upload of File with Dangerous Type Vulnerability

Added to KEV

Jan 26, 2026

Remediate by

Feb 16, 2026

Known ransomware use

Yes

Summary description

SmarterTools SmarterMail contains an unrestricted upload of file with dangerous type vulnerability that could allow an unauthenticated attacker to upload arbitrary files to any location on the mail server, potentially enabling remote code execution.

Required action

Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Notes

https://www.smartertools.com/smartermail/release-notes/current ; https://www.csa.gov.sg/alerts-and-advisories/alerts/al-2025-124/ ; https://nvd.nist.gov/vuln/detail/CVE-2025-52691

Related CVEs

CVECVSSEPSSKEVRExploitTitleMod.

CVE-2026-23760—

99.9%

KEV—80SmarterTools SmarterMail Authentication Bypass Using an Alternate Path or Channel Vulnerability—CVE-2026-24423—

99.7%

KEV—80SmarterTools SmarterMail Missing Authentication for Critical Function Vulnerability—