{"id":"CVE-2025-59689","aliases":["EUVD-2025-30249","GHSA-363h-22w6-hcrm"],"status":"published","title":"Libraesva ESG 4.5 through 5.5.x before 5.5.7 allows command injection via a compressed e-mail...","description":"Libraesva ESG 4.5 through 5.5.x before 5.5.7 allows command injection via a compressed e-mail attachment. For ESG 5.0 a fix has been released in 5.0.31. For ESG 5.1 a fix has been released in 5.1.20. For ESG 5.2 a fix has been released in 5.2.31. For ESG 5.4 a fix has been released in 5.4.8. For ESG 5.5. a fix has been released in 5.5.7.","severity":{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-12","score":0.01956,"percentile":0.80572,"model":"v2026.06.15"},"facts":{"in_kev":true,"known_exploited":true,"public_exploit":false,"fix_available":false},"cwes":["CWE-77"],"published":"2025-09-19T00:00:00Z","modified":"2026-06-17T09:46:31Z","kev":{"date_added":"2025-09-29","due_date":"2025-10-20","required_action":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","known_ransomware_use":"Unknown"},"exploitation":[{"source":"euvd","since":"2025-09-29"},{"source":"kev","since":"2025-09-29"}],"products":[{"vendor":"libraesva","product":"email security gateway"},{"vendor":"libraesva","product":"email_security_gateway"}],"references":[{"url":"https://www.libraesva.com/security-blog/","tags":["Vendor Advisory"]},{"url":"https://docs.libraesva.com/knowledgebase/security-advisory-command-injection-vulnerability-cve-2025-59689/","tags":["Vendor Advisory"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-59689","tags":["government-resource","US Government Resource"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-59689"},{"url":"https://docs.libraesva.com/knowledgebase/security-advisory-command-injection-vulnerability-cve-2025-59689"},{"url":"https://www.libraesva.com/security-blog"},{"url":"https://github.com/advisories/GHSA-363h-22w6-hcrm"}],"sources":{"cve":[{"id":"CVE-2025-59689","description":"Libraesva ESG 4.5 through 5.5.x before 5.5.7 allows command injection via a compressed e-mail attachment. For ESG 5.0 a fix has been released in 5.0.31. For ESG 5.1 a fix has been released in 5.1.20. For ESG 5.2 a fix has been released in 5.2.31. For ESG 5.4 a fix has been released in 5.4.8. For ESG 5.5. a fix has been released in 5.5.7.","status":"published","published":"2025-09-19T00:00:00Z","modified":"2026-02-26T17:48:25.122Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"cna"}],"cwes":["CWE-77"],"updated_at":"2026-11-02T14:32:47.812946Z"}],"euvd":[{"id":"EUVD-2025-30249","description":"Libraesva ESG 4.5 through 5.5.x before 5.5.7 allows command injection via a compressed e-mail attachment. For ESG 5.0 a fix has been released in 5.0.31. For ESG 5.1 a fix has been released in 5.1.20. For ESG 5.2 a fix has been released in 5.2.31. For ESG 5.4 a fix has been released in 5.4.8. For ESG 5.5. a fix has been released in 5.5.7.","status":"published","published":"2025-09-19T00:00:00Z","modified":"2026-02-26T17:48:25Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"exploited_since":"2025-09-29","updated_at":"2026-11-02T19:48:21.697838Z"}],"ghsa":[{"id":"GHSA-363h-22w6-hcrm","title":"Libraesva ESG 4.5 through 5.5.x before 5.5.7 allows command injection via a compressed e-mail...","description":"Libraesva ESG 4.5 through 5.5.x before 5.5.7 allows command injection via a compressed e-mail attachment. For ESG 5.0 a fix has been released in 5.0.31. For ESG 5.1 a fix has been released in 5.1.20. For ESG 5.2 a fix has been released in 5.2.31. For ESG 5.4 a fix has been released in 5.4.8. For ESG 5.5. a fix has been released in 5.5.7.","status":"published","published":"2025-09-19T21:31:21Z","modified":"2025-10-22T00:34:27Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"cwes":["CWE-77"],"updated_at":"2026-11-02T15:04:09.266545Z"}],"kev":[{"id":"CVE-2025-59689","title":"Libraesva Email Security Gateway Command Injection Vulnerability","description":"Libraesva Email Security Gateway (ESG) contains a command injection vulnerability which allows command injection via a compressed e-mail attachment.","cwes":["CWE-77"],"kev":{"date_added":"2025-09-29","due_date":"2025-10-20","required_action":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","known_ransomware_use":"Unknown"},"updated_at":"2026-11-02T17:00:15.999436Z"}],"nvd":[{"id":"CVE-2025-59689","description":"Libraesva ESG 4.5 through 5.5.x before 5.5.7 allows command injection via a compressed e-mail attachment. For ESG 5.0 a fix has been released in 5.0.31. For ESG 5.1 a fix has been released in 5.1.20. For ESG 5.2 a fix has been released in 5.2.31. For ESG 5.4 a fix has been released in 5.4.8. For ESG 5.5. a fix has been released in 5.5.7.","status":"published","published":"2025-09-19T20:15:40.34Z","modified":"2026-06-17T09:46:31.727Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"secondary"}],"cwes":["CWE-77"],"updated_at":"2026-11-02T14:11:30.865098Z"}]}}