Medium severity6.5NVD Advisory· Published Apr 28, 2025· Updated Jun 17, 2026

CVE-2025-34490

Description

GFI MailEssentials prior to version 21.8 is vulnerable to an XML External Entity (XXE) issue. An authenticated and remote attacker can send crafted HTTP requests to read arbitrary system files.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

Gfi/Mailessentials3 versions
cpe:2.3:a:gfi:mailessentials:*:*:*:*:*:*:*:*+ 2 more
- cpe:2.3:a:gfi:mailessentials:*:*:*:*:*:*:*:*range: <21.8
- (no CPE)range: <21.8
- (no CPE)range: 0

Patches

Vulnerability mechanics

References

frycos.github.io/vulns4free/2025/04/28/mailessentials.htmlnvdExploit
gfi.ai/products-and-solutions/network-security-solutions/mailessentials/resources/documentation/product-releasesnvdRelease Notes
www.vulncheck.com/advisories/gfi-mailessentials-xxe-arbitrary-file-readnvd

News mentions

No linked articles in our index yet.

cvss	0.423
epss	0.001
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000