All vulnerabilities
CVE-2025-59689

Libraesva Email Security Gateway Command Injection Vulnerability

Libraesva Email Security GatewayNetwork & edge
Open in ThreatlineRecord JSON
CVSS
6.1Medium
ExploitationExploited in the wildAdded to KEV 29 Sep 2025CISA KEV
Exploit odds (EPSS)1.86%Chance of exploitation activity in the next 30 days, higher than 79% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in5.0.31Also 5.1.20, 5.2.31 and 2 moreCVE List
Federal deadline20 Oct 2025Remediation due date for US federal agenciesCISA KEV
CISA required actionApply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. CISA KEV

What fixes it

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Timeline

  1. 19 Sep 2025, 00:00 UTCPublishedCVE List
  2. 29 Sep 2025Added to CISA KEVCISA KEV

Description

Libraesva Email Security Gateway (ESG) contains a command injection vulnerability which allows command injection via a compressed e-mail attachment.

Text from CVE List

Affected versions 5

  • Email Security Gatewayaffected: 4.5 before 5.0.31CVE List
  • Email Security Gatewayaffected: 5.1 before 5.1.20CVE List
  • Email Security Gatewayaffected: 5.2 before 5.2.31CVE List
  • Email Security Gatewayaffected: 5.3 before 5.4.8CVE List
  • Email Security Gatewayaffected: 5.5 before 5.5.7CVE List

References 4