The Cyber Security Agency of Singapore (CSA) has issued an urgent advisory about a maximum‑severity flaw in SmarterTools’ SmarterMail email platform that could allow attackers to execute code remotely without authentication.
Tracked as CVE‑2025‑52691 and rated CVSS 10.0, the vulnerability stems from an arbitrary file upload weakness that enables an unauthenticated attacker to place files anywhere on the mail server. CSA said successful exploitation could allow malicious files to be uploaded and executed, potentially giving an attacker full control of the affected system.
Security analysts note that vulnerabilities of this type are especially dangerous because uploaded files—such as malicious binaries, scripts, or web shells—may be automatically processed by the application. If interpreted as executable code, these files could run with the same privileges as the SmarterMail service.
SmarterMail, a popular alternative to Microsoft Exchange, is widely used by hosting providers including ASPnix Web Hosting, Hostek, and simplehosting.ch. The flaw affects Build 9406 and earlier and was patched in Build 9413, released on October 9, 2025.
CSA credited Chua Meng Han of the Centre for Strategic Infocomm Technologies (CSIT) for discovering and reporting the issue. While there is no evidence of active exploitation, users are strongly urged to upgrade to the latest release, Build 9483 (December 18, 2025), to ensure full protection.
