{"id":"CVE-2025-59689","kind":"vulnerability","aliases":["CVE-2025-59689"],"related":[],"title":"libraesva email security gateway: Libraesva ESG 4.5 through 5.5.x before 5.5.7 allows command injection via a compressed e-mail attachment","description":"Libraesva ESG 4.5 through 5.5.x before 5.5.7 allows command injection via a compressed e-mail attachment. For ESG 5.0 a fix has been released in 5.0.31. For ESG 5.1 a fix has been released in 5.1.20. For ESG 5.2 a fix has been released in 5.2.31. For ESG 5.4 a fix has been released in 5.4.8. For ESG 5.5. a fix has been released in 5.5.7.","summary":"Libraesva Email Security Gateway contains a command injection flaw triggered by a compressed email attachment. An attacker who sends a crafted attachment can run operating system commands on the gateway.","severity":"medium","cvss":6.1,"epss":null,"exploited":true,"exploited_at":"2025-09-29T00:00:00+00:00","products":[{"name":"libraesva email security gateway","fixed":["5.0.31"],"affected":">= 4.5, < 5.0.31","ecosystem":"vendor"},{"name":"libraesva email security gateway","fixed":["5.1.20"],"affected":">= 5.1.0, < 5.1.20","ecosystem":"vendor"},{"name":"libraesva email security gateway","fixed":["5.2.31"],"affected":">= 5.2.0, < 5.2.31","ecosystem":"vendor"},{"name":"libraesva email security gateway","fixed":["5.3.16"],"affected":">= 5.3.0, < 5.3.16","ecosystem":"vendor"},{"name":"libraesva email security gateway","fixed":["5.4.8"],"affected":">= 5.4.0, < 5.4.8","ecosystem":"vendor"},{"name":"libraesva email security gateway","fixed":["5.5.7"],"affected":">= 5.5.0, < 5.5.7","ecosystem":"vendor"},{"name":"Libraesva Email Security Gateway","fixed":[],"affected":"","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["email-security","exploited","libraesva","self-hosted","vendor"],"not_affected_if":["unknown"],"how_to_check":null,"fix":"Apply the mitigations from the vendor per CISA guidance; the sources do not name a fixed version.","status":"open","published_at":"2025-09-19T20:15:40+00:00","first_seen_at":"2026-10-23T19:11:51+00:00","triaged_at":"2026-10-23T20:44:44+00:00","updated_at":"2026-10-24T00:09:50+00:00","category":"vendor","confidence":0.6,"triage":{"at":"2026-10-23T20:44:44Z","model":"claude-haiku-5-5","output":{"fix":"Apply the mitigations from the vendor per CISA guidance; the sources do not name a fixed version.","reach":"internet","summary":"Libraesva Email Security Gateway contains a command injection flaw triggered by a compressed email attachment. An attacker who sends a crafted attachment can run operating system commands on the gateway.","category":"vendor","who_cares":["libraesva","email-security","self-hosted"],"confidence":0.6,"needs_auth":"no","worst_case":"Attacker runs arbitrary commands on the email gateway via a crafted attachment.","analyst_note":"Find the Libraesva vendor advisory and affected/fixed version list; the CISA KEV entry lists the exploited status but no versions or mitigation steps.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["unknown"],"user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000419,"input_tokens":2537,"output_tokens":330,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2025':24A,27A '-59689':25A,28A '4.5':7A,98C '5.0':116C '5.0.31':123C '5.1':126C '5.1.20':133C '5.2':136C '5.2.31':143C '5.4':146C '5.4.8':153C '5.5':9A,100C,156C '5.5.7':12A,103C,163C 'allow':13A,104C 'attach':22A,80B,87B,113C 'attack':82B 'command':14A,72B,92B,105C 'compress':18A,78B,109C 'contain':70B 'craft':86B 'cve':23A,26A 'e':20A,111C 'e-mail':19A,110C 'email':2A,30A,34A,38A,42A,46A,50A,54A,58B,67B,79B 'email-secur':57B 'esg':6A,97C,115C,125C,135C,145C,155C 'exploit':60B 'fix':118C,128C,138C,148C,158C 'flaw':74B 'gateway':4A,32A,36A,40A,44A,48A,52A,56A,69B,95B 'host':64B 'inject':15A,73B,106C 'libraesva':1A,5A,29A,33A,37A,41A,45A,49A,53A,61B,66B,96C 'mail':21A,112C 'oper':90B 'releas':121C,131C,141C,151C,161C 'run':89B 'secur':3A,59B,68B 'security':31A,35A,39A,43A,47A,51A,55A 'self':63B 'self-host':62B 'send':84B 'system':91B 'trigger':75B 'vendor':65B 'via':16A,107C 'x':10A,101C","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2025-09-19T20:15:40+00:00","kev":{"dateAdded":"2025-09-29","dueDate":"2025-10-20","requiredAction":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","knownRansomwareCampaignUse":"Unknown"},"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","cvss_by":"cve@mitre.org","poc_count":0,"sources":[{"source":"kev","external_id":"CVE-2025-59689","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2025-59689","severity":null,"published_at":"2025-09-29T00:00:00+00:00","modified_at":null,"first_seen_at":"2026-10-23T19:11:51+00:00","fetched_at":"2026-10-25T14:39:38+00:00","note":null},{"source":"nvd","external_id":"CVE-2025-59689","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-59689","severity":null,"published_at":"2025-09-19T20:15:40+00:00","modified_at":"2026-06-17T09:46:31+00:00","first_seen_at":"2026-10-23T23:44:51+00:00","fetched_at":"2026-10-23T23:44:51+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}