CVE-2025-59689: Libraesva ESG Command Injection Flaw Exploited in the Wild

Libraesva has issued an urgent advisory about a command injection flaw in its Email Security Gateway (ESG), tracked as CVE-2025-59689, affecting ESG versions from 4.5 onwards. The flaw can be exploited by a malicious e-mail containing a specially crafted compressed attachment, enabling arbitrary commands to be executed as a non-privileged user.

According to the advisory, the root cause lies in improper sanitization during the removal of active code from files within certain compressed archive formats, allowing attackers to bypass input sanitization. If exploited, attackers can run arbitrary shell commands under a non-privileged account, with potential use for persistence, lateral movement or privilege escalation.

The firm says there has already been at least one confirmed incident, with the threat actor believed to be a foreign hostile state entity, and the attack was targeted at a single appliance rather than broad financial crime campaigns. The affected versions include 5.0 (fixed in 5.0.31), 5.1 (fixed in 5.1.20), 5.2 (fixed in 5.2.31), 5.4 (fixed in 5.4.8) and 5.5 (fixed in 5.5.7), while 4.x appliances require manual migration, and Libraesva cloud customers have been fully upgraded to the latest fix.