CVE-2025-59689 is a command injection vulnerability in Libraesva Email Security Gateway, triggered by a specially crafted compressed e-mail attachment, that CISA confirms has been actively exploited; NVD has completed its analysis and assigned a CWE, but the only CVSS score on record is the CNA/MITRE-submitted 6.1, not an independent NVD Primary score.
Vulnerability summary
6.1
Medium
2.0%
EPSS score (FIRST)
Yes
CISA KEV catalog
2025-09-19
Published
Vulnerability ID: CVE-2025-59689 · Source: NVD (CNA/MITRE Secondary score only, not NVD Primary)
Affected components
| Component | CPE | Version range |
|---|---|---|
| Libraesva Email Security Gateway (ESG) | cpe:2.3:a:libraesva:email_security_gateway:*:*:*:*:*:*:*:* | 4.5 through 5.0.30 (fixed in 5.0.31); 5.1.0 through 5.1.19 (fixed in 5.1.20); 5.2.0 through 5.2.30 (fixed in 5.2.31); 5.3.0 through 5.3.15 (fixed in 5.3.16); 5.4.0 through 5.4.7 (fixed in 5.4.8); 5.5.0 through 5.5.6 (fixed in 5.5.7) |
What this means
CVE-2025-59689 (CWE-77, command injection) affects Libraesva Email Security Gateway (ESG). NVD's description states: "Libraesva ESG 4.5 through 5.5.x before 5.5.7 allows command injection via a compressed e-mail attachment," with per-branch fixes listed for 5.0, 5.1, 5.2, 5.4 and 5.5 (NVD).
NVD's vulnerability status is "Analyzed" and it has assigned CWE-77, but it has not published its own independent CVSS score for this CVE; the only CVSS metric on record is a Secondary score submitted by the CNA/MITRE: v3.1 6.1 (medium), vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N. This page reports that CNA-sourced number rather than presenting it as an NVD Primary assessment (NVD).
That 6.1 "medium" label understates real-world risk: CISA's own Stakeholder-Specific Vulnerability Categorization (SSVC) record for this CVE marks exploitation status as "active" and technical impact as "total," and the CVE was added to the Known Exploited Vulnerabilities (KEV) catalog on 2025-09-29 — only ten days after publication — with a required-action due date of 2025-10-20 under Binding Operational Directive 22-01 (CISA KEV).
Libraesva's own security advisory (published on the vendor's knowledge base and referenced directly by NVD) is the vendor source for the affected branches and fixed versions listed above; the vendor has since migrated its support documentation to libracyber.com, but the original advisory URL cited by NVD and CISA remains the canonical citation for this CVE (Libraesva Security Advisory: Command Injection Vulnerability (CVE-2025-59689)).
As of 2026-10-29, FIRST scores the probability of exploitation at 0.01956 (80.224th percentile) — low in absolute terms but still well above the median CVE, consistent with a flaw that requires reaching the gateway's mail pipeline rather than an open, pre-auth network listener (FIRST EPSS).
Because this is a confirmed KEV entry with documented active exploitation despite its medium CVSS label, any Libraesva ESG appliance on an affected branch should be updated to the fixed version for that branch (5.0.31, 5.1.20, 5.2.31, 5.3.16, 5.4.8 or 5.5.7) immediately, regardless of the numeric severity score.
Evidence
- Libraesva ESG 4.5 through 5.5.x before 5.5.7 allows command injection via a compressed e-mail attachment; per-branch fixes exist for 5.0, 5.1, 5.2, 5.3, 5.4 and 5.5. — NVD
- NVD status is "Analyzed" with CWE-77 assigned, but NVD has not published its own CVSS score; the only metric on record is a CNA/MITRE Secondary score of 6.1, vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N. — NVD
- Added to the CISA Known Exploited Vulnerabilities catalog on 2025-09-29, due date 2025-10-20; CISA's SSVC record marks exploitation as "active" and technical impact as "total." — CISA KEV
- Vendor advisory documents affected ESG branches (4.5-5.5.x) and the specific fixed version for each branch. — Libraesva Security Advisory: Command Injection Vulnerability (CVE-2025-59689)
- EPSS score is 0.01956 (80.224th percentile) as of 2026-10-29. — FIRST EPSS
