CVE-2025-52691

**CVE-2025-52691: SmarterMail Unrestricted File Upload** SmarterTools SmarterMail allows unauthenticated attackers to upload arbitrary files to any location on the mail server due to missing file type validation. An attacker can exploit this to place webshells or executables on the server and achieve remote code execution. **Actions for your SOC:** 1. Identify all SmarterMail instances in your environment and check for available patches from SmarterTools. 2. If patching cannot be immediate, restrict network access to SmarterMail upload endpoints and monitor upload directories for suspicious file creation (webshell extensions, executable types). 3. Review mail server logs and filesystem timestamps for evidence of exploitation—look for unexpected files in web-accessible directories or system paths created before the current date.