VulnerabilityModified

CVE-2025-34490

GFI MailEssentials prior to version 21.8 is vulnerable to an XML External Entity (XXE) issue.

MEDIUM 6.5EPSS 0.69%

Does this matter?

Lower severity and a low EPSS score (0.69%). Track it; it rarely justifies an emergency change on its own.

Description

GFI MailEssentials prior to version 21.8 is vulnerable to an XML External Entity (XXE) issue. An authenticated and remote attacker can send crafted HTTP requests to read arbitrary system files.

CVSS 3.1: 6.5 MEDIUMCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
EPSS: 0.69% probability · 51th percentile
CISA KEV: Not listed
Weakness: CWE-611
Affected: gfi/mailessentials
Source: disclosure@vulncheck.com

References

https://frycos.github.io/vulns4free/2025/04/28/mailessentials.htmlExploit
https://gfi.ai/products-and-solutions/network-security-solutions/mailessentials/resources/documentation/product-releasesRelease Notes
https://www.vulncheck.com/advisories/gfi-mailessentials-xxe-arbitrary-file-read

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.