CVEvulnerability
CVE-2025-34490
6.5 MEDIUM
Official page ↗
- Status
- Modified
- Published
- 2025-04-28
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 3.1 ([email protected])
- 6.5 MEDIUM — CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
- CVSS 3.1 ([email protected])
- 6.5 MEDIUM — CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
- Weaknesses
- CWE-611
Description
GFI MailEssentials prior to version 21.8 is vulnerable to an XML External Entity (XXE) issue. An authenticated and remote attacker can send crafted HTTP requests to read arbitrary system files.
Affected configurations
• gfi mailessentials (< 21.8)
Related
Weakness · CWE (1)
- CWE-611 Improper Restriction of XML External Entity Reference weakness
References
- https://frycos.github.io/vulns4free/2025/04/28/mailessentials.html Exploit
- https://gfi.ai/products-and-solutions/network-security-solutions/mailessentials/resources/documentation/product-releases Release Notes
- https://www.vulncheck.com/advisories/gfi-mailessentials-xxe-arbitrary-file-read www.vulncheck.com