CVE-2025-34490
GFI MailEssentials < 21.8 XXE Arbitrary File Read
- State
- Published
- Severity
- 6.5 Medium
- Published
- Apr 28, 2025
- Updated
- Nov 19, 2025
- Reserved
- Apr 15, 2025
Description
GFI MailEssentials prior to version 21.8 is vulnerable to an XML External Entity (XXE) issue. An authenticated and remote attacker can send crafted HTTP requests to read arbitrary system files.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 3.1 | 6.5 Medium | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N | VulnCheck |
Weaknesses
- CWE-611 Improper Restriction of XML External Entity Reference
Affected Products
| Product | Versions |
|---|---|
MailEssentialsGFI |
|
References
- https://frycos.github.io/vulns4free/2025/04/28/mailessentials.htmlexploittechnical-description
- https://gfi.ai/products-and-solutions/network-security-solutions/mailessentials/resources/documentation/product-releasesvendor-advisory
- https://www.vulncheck.com/advisories/gfi-mailessentials-xxe-arbitrary-file-readthird-party-advisory
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.