Singapore CSA warns of maximun severity SmarterMail RCE flaw

Singapore’s Cyber Security Agency of Singapore (CSA) warns of CVE-2025-52691, a maximum severity flaw in SmarterMail that enables unauthenticated remote code execution via arbitrary file upload. According to CSA’s advisory, the vulnerability has a CVSS score of 10.0 and could allow an unauthenticated attacker to upload arbitrary files to any location on the mail server, potentially enabling remote code execution.

The issue affects SmarterMail builds 9406 and earlier, with a recommendation to update to Build 9413 immediately. The flaw was responsibly disclosed by Mr Chua Meng Han from the Centre for Strategic Infocomm Technologies (CSIT). At present, it is unclear whether the vulnerability is being exploited in attacks in the wild.