GFI MailEssentials versions prior to 21.8 contain an XML External Entity (XXE) vulnerability that allows an authenticated remote attacker to send crafted HTTP requests to read arbitrary system files. This vulnerability can lead to unauthorized disclosure of sensitive information. The issue is identified as CVE-2025-34490 and has a CVSS 3.1 base score of 6.5, indicating a medium severity level.