What’s Vulnerable › Vulnerabilities

CVE-2025-34490: GFI MailEssentials < 21.8 XXE Arbitrary File Read

• Severity: medium (CVSS 6.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.7% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2025-04-28 · updated 2026-06-17
• Weakness: CWE-611

Description

GFI MailEssentials prior to version 21.8 is vulnerable to an XML External Entity (XXE) issue. An authenticated and remote attacker can send crafted HTTP requests to read arbitrary system files.

Affected products

• GFI Software MailEssentials AI: before 21.8 — fixed in 21.8

How to fix

Upgrade to a fixed version: GFI Software MailEssentials AI 21.8. Check the vendor advisory for mitigations.

References

• https://frycos.github.io/vulns4free/2025/04/28/mailessentials.html
• https://gfi.ai/products-and-solutions/network-security-solutions/mailessentials/resources/documentation/product-releases
• https://www.vulncheck.com/advisories/gfi-mailessentials-xxe-arbitrary-file-read

Get alerted when CVE-2025-34490 or the next vulnerability affects your stack