The year 2026 has arrived, and while we eagerly await the annual SSLVPN ITW exploitation programming in January, we're back from the holiday break with some intriguing findings. A vulnerability alert in SmarterTools' SmarterMail solution, accompanied by an advisory from Singapore's Cyber Security Agency (CSA), has caught our attention. CVE-2025-52691, a pre-auth RCE, scored a perfect 10/10 on the industry scale, making it a fascinating discovery.
SmarterMail, described as a secure email and collaboration server, boasts an affordable alternative to Microsoft Exchange. However, a curious detail emerged during our investigation. The vulnerability was reportedly fixed in build 9413, yet the advisory and CVE entry were released at the end of December 2025, almost three months later. This raises questions: Was the vulnerability silently patched, and why did customers have to wait for official information?
The narrative takes an intriguing turn as we delve into the technical details of CVE-2025-52691. By diffing vulnerable and non-vulnerable versions, we uncover a critical parameter related to GUIDs that was added in the patched build. This leads us to explore the FileUploadController API endpoint, which allows unauthenticated file uploads.
As we analyze the code, we discover that the contextData parameter, when deserialized, controls the guid value, which is then used in an upload operation for attachments. This is where the vulnerability lies, allowing for path traversal and an unauthenticated file write.
To exploit this vulnerability, we craft an HTTP request with specific parameters, including setting the context to 'attachment' and leveraging the guid parameter for path traversal. The final request triggers the vulnerable code path, leading to an arbitrary file write and ultimately, a remotely exploitable RCE.
In addition to providing a Detection Artifact Generator for organizations to assess their exposure, we also offer a glimpse into the watchTowr Platform. By combining proactive threat intelligence and external attack surface management, the platform empowers organizations to rapidly respond to emerging threats, giving them the precious time needed to act.
Gain early access to our research and take control of your exposure with the watchTowr Platform. REQUEST A DEMO today and stay ahead of the curve.
