CVE-2025-34490: medium-severity vulnerability in GFI MailEssentials
GFI MailEssentials < 21.8 XXE Arbitrary File Read
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
No sign of exploitation. No public exploitation artifact known so far.
GFI MailEssentials before version 21.8 has a flaw that lets authenticated attackers read any file on the server by sending specially crafted XML requests. This is dangerous because sensitive files like passwords or configuration data could be exposed.
The application fails to properly validate XML input, allowing XXE injection attacks. An authenticated remote attacker can leverage this vulnerability by submitting malicious XML payloads to access arbitrary files on the underlying system, potentially disclosing sensitive configuration, credentials, or other confidential data.
In the same product, most dangerous first.