Libraesva has released a security update to address a vulnerability in its Email Security Gateway (ESG) solution that it said has been exploited by state-sponsored threat actors. The vulnerability, tracked as CVE-2025-59689, carries a CVSS score of 6.1, indicating medium severity. "Libraesva ESG is affected by a command injection flaw that can be triggered by a malicious email containing a specially crafted compressed attachment, allowing potential execution of arbitrary commands as a non-privileged user," Libraesva said in an advisory. "This occurs due to an improper sanitization during the removal of active code from files contained in some compressed archive formats." In a hypothetical attack scenario, an attacker could exploit the flaw by sending an email containing a specially…