Libraesva Email Security Gateway Command Injection Vulnerability. Actively exploited: CISA added this vulnerability to its Known Exploited Vulnerabilities catalog on 29/09/2025. Patch affected systems as an emergency.
| Package | Affected versions | Patched versions |
|---|---|---|
| email security gateway | ≥ 4.5, < 5.0.31≥ 5.1.0, < 5.1.20≥ 5.2.0, < 5.2.31≥ 5.3.0, < 5.3.16≥ 5.4.0, < 5.4.8≥ 5.5.0, < 5.5.7 | 5.0.315.1.205.2.315.3.165.4.85.5.7 |
Libraesva ESG 4.5 through 5.5.x before 5.5.7 allows command injection via a compressed e-mail attachment. For ESG 5.0 a fix has been released in 5.0.31. For ESG 5.1 a fix has been released in 5.1.20. For ESG 5.2 a fix has been released in 5.2.31. For ESG 5.4 a fix has been released in 5.4.8. For ESG 5.5. a fix has been released in 5.5.7.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free