Vulnerability Intelligence Report
GFI MailEssentials < 21.8 XXE Arbitrary File Read
CVE-2025-34490
GFI MailEssentials prior to version 21.8 is vulnerable to an XML External Entity (XXE) issue. An authenticated and remote attacker can send crafted HTTP requests to read arbitrary system files.
No Active Exploit Signals
CVSS Base Score
6.5
MEDIUM
Exploitability:2.9
Impact Score:3.6
EPSS Probability:0.59%
Executive Threat Verdict
Evaluating...
Evaluating Threat Landscape...
Assessing known weaponization, exploitation telemetry, and federal advisories.
Attack Surface
—
Authentication
—
Weaponization
—
SSVC Action
—
Weaknesses (CWE)
CWE-611 ↗CWE-611 Improper Restriction of XML External Entity Reference
Affected Products & Versions
| Vendor | Product | Affected Versions |
|---|---|---|
| GFI | MailEssentials | 0 < 21.8 (affected) |
References & Technical Advisories
No reference links found.
Threat Intelligence Signals
EPSS Score
0.586%
GitHub Advisory
Identity & Timeline
| Status | PUBLISHED |
| Assigning Authority | VulnCheck · Bug Bounty Provider · USA |
| Reserved | 2025-04-15T19:15:22 |
| Published | 2025-04-28T19:02:03 |
| Last Updated | 2025-11-19T01:26:14 |
Community Chatter & Buzz