CSA Issues Alert on Critical SmarterMail Bug Allowing Remote Code Execution

According to the Cyber Security Agency of Singapore (CSA), a maximum-severity flaw in SmarterTools SmarterMail could allow remote code execution via arbitrary file uploads, with no authentication required. The vulnerability is tracked as CVE-2025-52691 and carries a CVSS score of 10.0, affecting SmarterMail builds up to Build 9406; exploitation could enable an unauthenticated attacker to upload files to the mail server and potentially execute code.

CSA notes that dangerous file types uploaded could be processed by the application's environment, creating a path to code execution if executed as part of the SmarterMail service. The advisory credits Chua Meng Han from the Centre for Strategic Infocomm Technologies (CSIT) for discovering and reporting the vulnerability, and states Build 9413 fixes the issue, with Build 9483 released on 18 December 2025 for optimal protection. Users are advised to update to the latest version (Build 9483) to mitigate the risk, though there is no mention of the flaw being exploited in the wild.