CVE-2025-52691 Exploit Metadata

PoC files

1 file

File viewing is interactive and short-lived. Downloads are password-protected ZIP archives using password eip.

Analysisdeepseek-v4-pro:cloud · 2026-08-11

Technical assessment

A Metasploit module that exploits CVE-2025-52691, a pre-auth directory traversal in SmarterMail's /api/upload endpoint, to upload an ASPX web shell (Windows) or a cron-based payload (Unix) for remote code execution.

Backdoor review

No backdoor observed in reviewed code

The reviewed Metasploit module source code implements a documented exploit for CVE-2025-52691. It uploads an ASPX web shell (Windows) or a cron-based command payload (Unix) to achieve remote code execution, consistent with the stated vulnerability and module description. No concealed, deceptive, or operator-directed harmful behavior beyond the declared exploit functionality was observed.

ClassificationExploit

Model confidence100%

AuthenticationNot required

Languagesruby

Target softwareSmarterTools SmarterMail

Attack typesremote code executionfile uploaddirectory traversal

Evidence & reasoningClassification basis · observed behavior · safety review

Technical evidence

Classification basis and observed behavior

Classification basis

The module is a complete exploit that actively uploads and executes a payload on a vulnerable target. It constructs a malicious request with directory traversal, delivers a web shell or cron-based command execution, and triggers the payload to gain a session. This matches the 'exploit' classification as code intended to exercise a vulnerability for remote code execution.

modules/exploits/multi/http/smartermail_guid_file_upload.rb:6modules/exploits/multi/http/smartermail_guid_file_upload.rb:103-128modules/exploits/multi/http/smartermail_guid_file_upload.rb:130-158

Requirements

Target must be running a vulnerable version of SmarterMail (before 100.0.9413).modules/exploits/multi/http/smartermail_guid_file_upload.rb:20
The /api/upload endpoint must be accessible and accept multipart POST requests.modules/exploits/multi/http/smartermail_guid_file_upload.rb:114-119

Observed behavior

Sends a multipart POST request to /api/upload with a contextData JSON field containing a 'guid' key with directory traversal sequences (e.g., '../' repeated) to place a file outside the intended upload directory.modules/exploits/multi/http/smartermail_guid_file_upload.rb:111
On Windows, uploads an ASPX web shell that executes an attacker-supplied command via cmd.exe, then triggers it with an HTTP GET request.modules/exploits/multi/http/smartermail_guid_file_upload.rb:79-97modules/exploits/multi/http/smartermail_guid_file_upload.rb:135-142
On Unix, uploads a raw command payload to /tmp and writes a cron job to /etc/cron.d that executes the payload every minute.modules/exploits/multi/http/smartermail_guid_file_upload.rb:144-156

Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Exploit Behavior: Uploads ASPX web shell to /inetpub/wwwroot on Windows targetConsistent with module description of uploading a malicious ASPX web shell to the web root for RCE.modules/exploits/multi/http/smartermail_guid_file_upload.rb:133-136
Exploit Behavior: Uploads payload to /tmp and creates cron job in /etc/cron.d on Unix targetConsistent with module description of leveraging the upload vulnerability for RCE; cron job executes the uploaded payload.modules/exploits/multi/http/smartermail_guid_file_upload.rb:144-156
Exploit Behavior: Uses directory traversal in contextData JSON guid fieldMatches the CVE description of unsanitized guid key allowing directory traversal to upload files to arbitrary locations.modules/exploits/multi/http/smartermail_guid_file_upload.rb:111

Review boundaries

What the analysis did not establish

Analysis is based solely on the provided Metasploit module source code and metadata; framework mixins, libraries, and external payloads referenced by the module are not included in the evidence.
The module's actual runtime behavior, reliability, and safety are not verified; classification reflects the artifact's apparent purpose as described in the code.
Only the module source file was reviewed; Metasploit framework mixins, libraries, and external payloads are not expanded or analyzed.
Binary files were flagged as metadata-only and not inspected, but no binary files were present in the evidence.

Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.

Linked vulnerabilities

CVE-2025-52691