CVE-2025-52691

Successful exploitation of the vulnerability could allow an unauthenticated attacker to upload arbitrary files to any location on the mail server, potentially enabling remote code execution.

CVSS v3.1

10.0 CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

EPSS

85.66% chance of exploitation in the next 30 days, 100th percentile

CISA KEV

added 2026-01-26, used in ransomware campaigns

Nuclei

critical

Published

2025-12-29

Updated

2026-02-26

Proof-of-concept exploits (7)

• DeathShotXD/CVE-2025-52691-APT-PoC
• Udyz/CVE-2025-52691
• mohammadzarnian1357/Ashwesker-CVE-2025-52691
• ninjazan420/CVE-2025-52691-PoC-SmarterMail-authentication-bypass-exploit-WT-2026-0001
• rimbadirgantara/CVE-2025-52691-poc
• watchtowrlabs/watchTowr-vs-SmarterMail-CVE-2025-52691
• you-ssef9/CVE-2025-52691

Nuclei templates (1)

• projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-52691.yaml

Metasploit modules (1)

• rapid7/metasploit-framework/blob/master/modules/exploits/multi/http/smartermail_guid_file…

Exploit collections (1)

• zan8in/afrog/blob/main/pocs/afrog-pocs/CVE/2025/CVE-2025-52691.yaml

References

• CVE Record
• NVD entry

Related

• CVE-2020-1472
• CVE-2025-53770
• CVE-2026-22812
• CVE-2026-1529
• CVE-2026-1729
• CVE-2024-51378