Libraesva ESG Vulnerability Allows Attackers to Execute Malicious Commands

A critical command injection flaw in Libraesva ESG email security gateways allows attackers to execute arbitrary commands via specially crafted compressed email attachments. The vulnerability, designated CVE-2025-59689, affects Libraesva ESG versions from 4.5 onwards and has allegedly been exploited by what appears to be a foreign state actor.

The flaw arises from improper sanitization during removal of active code from files in compressed archives, enabling command injection when the system processes attachments and potentially escaping the security sandbox to run commands on the underlying system.

Libraesva has released emergency patches across multiple product versions, with ESG 5.0 to 5.5 requiring specific updates such as 5.0.31, 5.1.20, 5.2.31, 5.3.16, 5.4.8, and 5.5.7, and a patch that includes the core sanitization fix plus an automated indicators of compromise scan and a self‑assessment module.

The vendor reports that automated patch deployment rolled out to all ESG 5.x installations within 17 hours of discovery, including automatic updates for cloud customers; one incident of active exploitation has been confirmed, attributed to a foreign hostile state entity. According to Libraesva, legacy 4.x versions are end-of-support and must upgrade to 5.x to receive protection.