CVE-2025-13033 is a vulnerability in the email parsing library (nodemailer) used in Red Hat Ceph Storage container images based on Ceph 8.1. The flaw arises from improper handling of specially formatted recipient email addresses containing quoted local-parts with embedded '@' characters. An attacker who controls the destination email input can craft a recipient address that causes the application to send emails to an external attacker-controlled address instead of the intended internal recipient. This misrouting can lead to significant data leakage and bypass of security filters and access controls. Red Hat rates the impact on its products as Moderate because exploitation requires attacker control over the destination email input. No mitigation or fix is currently available.

Successful exploitation allows an attacker to exfiltrate sensitive information by causing emails to be sent to unintended external addresses. This compromises data confidentiality and bypasses security filters and access controls. However, exploitation requires the attacker to have direct control over the destination email input, limiting the attack surface. There are no known exploits in the wild at this time.

Currently, there is no available mitigation or fix for this vulnerability. Users should monitor Red Hat advisories for updates. Since exploitation requires control over the destination email input, restricting or validating email inputs may reduce risk but is not an official mitigation.