Nation-State hackers exploit Libraesva Email Gateway flaw

State-sponsored hackers exploited a command injection flaw tracked as CVE-2025-59689 in Libraesva Email Gateway, with Libraesva describing the issue as allowing arbitrary commands to be executed as a non-privileged user via a malicious e‑mail containing a specially crafted compressed attachment.

Libraesva ESG, the company’s secure email gateway solution, notes that the vulnerability stems from improper sanitization during the removal of active code from files in certain archive formats, and that at least one incident has been identified attributed to a foreign hostile state entity. The flaw allows an attacker to trigger the vulnerability by sending such emails, and the archive manipulation bypasses the app’s sanitization logic to execute commands.

The vulnerability affects Libraesva ESG versions from 4.5 up to 5.5, with the company stating it addressed the issue only for ESG 5.x versions since 4.x is no longer supported. The firm initially identified a single confirmed incident, emphasising the precision of the threat actor and the need for rapid, comprehensive patch deployment. According to Security Affairs, the article carries this attribution and details.