DO SMART PEOPLE EVER SAY THEY'RE SMART? (SMARTERTOOLS SMARTERMAIL PRE-AUTH RCE CVE-2025-52691)

Summary from the TLDR InfoSec newsletter

A critical pre-auth remote code execution flaw (CVE-2025-52691) in SmarterTools SmarterMail, a business email and collaboration server for Windows and Linux, arises from an unauthenticated file upload endpoint that accepts attacker-controlled parameters. It includes a GUID used to construct file paths, enabling arbitrary file writes via path traversal and by crafting a multipart/form-data request with specific context and contextData values. With a malicious file, an attacker can place a web shell in the webroot and gain full remote code execution.