Medium severity · published Apr 28, 2025
CVE-2025-34490
GFI MailEssentials prior to version 21.8 is vulnerable to an XML External Entity (XXE) issue
6.5
CVSS
0.7%
EPSS
No
On KEV
Description
GFI MailEssentials prior to version 21.8 is vulnerable to an XML External Entity (XXE) issue. An authenticated and remote attacker can send crafted HTTP requests to read arbitrary system files.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.7% · higher than 54% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
MA
Mailessentials · Gfi
before 21.8 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-34490
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-34490
Exploit
https://frycos.github.io/vulns4free/2025/04/28/mailessentials.html
Release Notes
https://gfi.ai/products-and-solutions/network-security-solutions/mailessentials/resources/documentation/product-releases
www.vulncheck.com
https://www.vulncheck.com/advisories/gfi-mailessentials-xxe-arbitrary-file-read
More from Mailessentials
8.8
CVE-2025-34491
GFI MailEssentials prior to version 21.8 is vulnerable to a .NET deserialization issue
7.8
CVE-2025-34489
GFI MailEssentials prior to version 21.8 is vulnerable to a local privilege escalation issue
5.4
CVE-2026-23619
GFI MailEssentials AI < 22.4 General Settings Local Domains Domain Description Stored XSS
5.4
CVE-2026-23618
GFI MailEssentials AI < 22.4 Anti-Spam Spam Keyword Checking Subject Condition Stored XSS
5.4
CVE-2026-23617
GFI MailEssentials AI < 22.4 Anti-Spam Spam Keyword Checking Body Condition Stored XSS