CVE-2025-59689

MEDIUM KEV

Libraesva ESG 4.5-5.5.x - OS Command Injection via Compressed Email Attachment

Title source: llm
STIX 2.1

Exploitation Summary

CVE-2025-59689 is actively exploited and listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, added September 29, 2025.

Description

Libraesva ESG 4.5 through 5.5.x before 5.5.7 allows command injection via a compressed e-mail attachment. For ESG 5.0 a fix has been released in 5.0.31. For ESG 5.1 a fix has been released in 5.1.20. For ESG 5.2 a fix has been released in 5.2.31. For ESG 5.4 a fix has been released in 5.4.8. For ESG 5.5. a fix has been released in 5.5.7.

References (3)

Core 3

Scores

CVSS v3 6.1
EPSS 0.0692
EPSS Percentile 91.6%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

CISA SSVC

Vulnrichment
Exploitation active
Automatable no
Technical Impact total

Details

CISA KEV 2025-09-29
VulnCheck KEV 2025-09-22
ENISA EUVD EUVD-2025-30249
CWE
CWE-77
Status published
Products (1)
libraesva/email_security_gateway 4.5 - 5.0.31
Published Sep 19, 2025
KEV Added Sep 29, 2025
Tracked Since Feb 18, 2026