CVE-2025-52691

Summary dbcve.org

An unauthenticated attacker can upload arbitrary files to any location on the affected mail server. Combined with the ability to place files in any directory, this essentially provides remote code execution capability, as the attacker can overwrite system files, configuration files, or place executable scripts in web-accessible directories.

Mitigation

Apply vendor patches immediately when available; in the interim, restrict network exposure of the mail server to trusted networks only, and disable or severely restrict file attachment handling features if possible.