rxerium/CVE-2025-52691

GitHubRepository PoCScanner

PoC files

3 files

File viewing is interactive and short-lived. Downloads are password-protected ZIP archives using password eip.

GitHub
Analysisdeepseek-v4-pro:cloud ·

Technical assessment

A Nuclei template and README that detect SmarterMail instances vulnerable to CVE-2025-52691 by checking the build version via a GET request and regex extraction. No exploit code is present.

Backdoor review

No backdoor observed in reviewed code

The repository contains a Nuclei template (CVE-2025-52691.yaml) and a README.md for detecting a SmarterMail arbitrary file upload vulnerability. The template performs a benign GET request to fingerprint the target and extract version information; it does not execute any exploit, upload files, or establish remote access. The README provides usage instructions and contact links but contains no hidden commands, obfuscated payloads, or instructions to execute untrusted code. No backdoor, trojan, or deceptive behavior is present in the reviewed text files.

ClassificationScanner
Model confidence95%
AuthenticationNot required
Languagesyamlmarkdown
Target softwareSmarterMail
Attack typesdetectionversion-check
Evidence & reasoningClassification basis · observed behavior · safety review
Technical evidence

Classification basis and observed behavior

Classification basis

The artifact is a Nuclei template that performs version detection and comparison to identify vulnerable SmarterMail instances. It does not contain any code to upload files or execute commands; it only reports whether a target matches the vulnerable version criteria. The README explicitly describes it as a 'detection method' and 'vulnerability detection script'.

CVE-2025-52691.yaml:1-64README.md:5-7README.md:50

Requirements

  • Target must be running SmarterMail with the /interface/root#/login endpoint accessible.CVE-2025-52691.yaml:28-29

Observed behavior

  • Sends a GET request to the target's /interface/root#/login path.CVE-2025-52691.yaml:27-29
  • Checks if the response body contains 'ng-app="smartermail"' and returns HTTP status 200.CVE-2025-52691.yaml:33-40
  • Extracts the build number from the stProductVersion JavaScript variable using regex.CVE-2025-52691.yaml:54-60
  • Flags the target as vulnerable if the extracted build number is less than or equal to 9406.CVE-2025-52691.yaml:42-44
Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Nuclei Template
CVE-2025-52691.yamlThe template sends a GET request to /interface/root#/login and uses matchers and extractors to identify SmarterMail and its build version. It does not perform any write, upload, or command execution actions.CVE-2025-52691.yaml:26-64
Contact Method
Signal link: https://signal.me/#eu/0Qd68U1ivXNdWCF4hf70UYFo7tB0w-GQqFpYcyV6-yr4exn2SclB6bFeP7wTAxQwThe README provides a Signal contact link for questions. The link itself is not executed by the artifact and does not constitute a backdoor.README.md:50
Review boundaries

What the analysis did not establish

  • One file (LICENSE) was omitted from the evidence, but it is unlikely to contain exploit code.
  • The evidence does not include the actual execution output of the template, only its static definition.
  • One file (LICENSE) was omitted from the text content and not reviewed; its metadata indicates it is a text file but its content was not supplied.
  • The review is limited to the static content of the provided text files; no dynamic or runtime behavior was analyzed.
Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.

Linked vulnerabilities

1