What is CVE-2025-34490?

CVE-2025-34490 is a medium-severity vulnerability in Gfi Mailessentials, classified under Improper Restriction of XML External Entity Reference (XXE). CVSS score: 6.5/10. Published 2025-04-28.

How severe is CVE-2025-34490?

Medium severity. CVSS v3 base score is 6.5 out of 10.

XXE in Gfi Mailessentials

CVE-2025-34490

GFI MailEssentials prior to version 21.8 is vulnerable to an XML External Entity (XXE) issue. An authenticated and remote attacker can send crafted HTTP requests to read arbitrary system files.

Vulnerability class: XXE (XML External Entity)

EPSS: 0.006 (46.0th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 6.5 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N.

Affected products

Gfi Mailessentials — versions 0

Weakness classification (CWE)

CWE-611 — Improper Restriction of XML External Entity Reference (XXE)

References

disclosure@vulncheck.com (Exploit, technical-description, exploit)
disclosure@vulncheck.com (vendor-advisory, Release Notes)
disclosure@vulncheck.com (third-party-advisory)

Frequently asked questions

What is CVE-2025-34490?: CVE-2025-34490 is a medium-severity vulnerability in Gfi Mailessentials, classified under Improper Restriction of XML External Entity Reference (XXE). CVSS score: 6.5/10. Published 2025-04-28.
How severe is CVE-2025-34490?: Medium severity. CVSS v3 base score is 6.5 out of 10.