State-Sponsored Hackers Exploiting Libraesva Email Security Gateway Vulnerability

Libraesva has released a security update for its Email Security Gateway (ESG) after state-sponsored threat actors exploited a vulnerability tracked as CVE-2025-59689, which has a CVSS score of 6.1 (medium).

According to Libraesva, the flaw is a command injection vulnerability triggered by a malicious email containing a specially crafted compressed attachment, enabling potential execution of arbitrary commands as a non-privileged user due to improper sanitization during the removal of active code from files in some archive formats. In a hypothetical attack, an attacker could send such an email to exploit the flaw and leverage the application's sanitization logic to run shell commands.

Libraesva noted that versions 4.5 through 5.5.x before 5.5.7 are affected, with fixes released in multiple version streams, and that versions below 5.0 are end-of-support and must be manually upgraded to a supported release. The company also confirmed one incident of abuse and said the threat actor is believed to be a foreign hostile state entity, emphasising the need for rapid, comprehensive patch deployment, with Libraesva deploying a fix within 17 hours of flagging the abuse. Users are urged to update their ESG software to the latest version as soon as possible to mitigate potential threats.