Zimbra Vulnerabilities and Affected Products

Open in search

Explore source-attributed vulnerabilities associated with Zimbra products.

Products

Showing 15 vulnerabilities on this page

Signals CISA KEV Ransomware Nuclei
VulnerabilityTitle and contextCVSSEPSSPoCsSignals

Zimbra Collaboration OnlyOffice Integration Weak Cryptographic Key Generation Vulnerability

In Zimbra Collaboration (ZCS) before 10.1.17, weak cryptographic key generation vulnerability exists in the OnlyOffice integration. The zimbraDocumentEditingJwtSecret is generated using an insecure random number generator, resulting in insufficient entropy. An attacker who obtains a JWT signed with the generated secret may be able to recover the JWT signing secret through offline brute-force, potentially enabling JWT forgery.

CWE-1241Aug 13, 2026
CVSS6.3v3.1EPSS-PoCs0SignalsSTIX

Zimbra Collaboration Exchange Web Services Endpoint Cross-Site Request Forgery

In Zimbra Collaboration (ZCS) before 10.1.17, a Cross-Site Request Forgery (CSRF) vulnerability exists in the Exchange Web Services (EWS) endpoint of Zimbra Collaboration (ZCS) due to insufficient validation of request content types. An attacker can exploit this vulnerability by causing an authenticated user to submit a crafted request, potentially allowing unauthorized actions to be performed on behalf of the victim.

CWE-352Aug 13, 2026
CVSS3.1v3.1EPSS-PoCs0SignalsSTIX

Zimbra Collaboration Classic Web Client Local File Inclusion

In Zimbra Collaboration before 10.1.17, a local file inclusion (LFI) vulnerability exists in the Zimbra Classic Web Client due to improper validation of the fu request parameter. An unauthenticated attacker can exploit this vulnerability by supplying a crafted path, potentially allowing unauthorized disclosure of protected files, such as WEB-INF/web.xml, within the web application directory. This occurs in the Forward servlet.

CWE-669Aug 13, 2026
CVSS3.1v3.1EPSS-PoCs0SignalsSTIX

Zimbra Collaboration Briefcase Path Traversal Vulnerability

In Zimbra Collaboration (ZCS) before 10.1.17, a path traversal vulnerability exists in the Zimbra Briefcase document editing functionality due to improper validation of the packages parameter. An authenticated attacker can exploit this vulnerability by supplying a crafted path traversal sequence, potentially allowing unauthorized disclosure of sensitive files within the web application directory.

CWE-24Aug 13, 2026
CVSS3.1v3.1EPSS-PoCs0SignalsSTIX

Zimbra Collaboration Classic Web Client Stored Cross-Site Scripting via Attachment Preview

In Zimbra Collaboration (ZCS) before 10.1.17, a stored cross-site scripting (XSS) vulnerability exists in the Zimbra Classic Web Client due to insufficient sanitization of specific attachment content during inline preview. An attacker can send a crafted email containing a malicious attachment that, when previewed by a user, executes arbitrary JavaScript within the victim's browser session. Successful exploitation may allow an attacker to perform unauthorized actions on behalf of the victim user,…

CWE-79Aug 13, 2026
CVSS6.1v3.1EPSS-PoCs0SignalsSTIX

Zimbra Collaboration SaveDraftRequest Authorization Bypass

An authorization bypass vulnerability exists in Zimbra Collaboration (ZCS) before 10.1.17 due to improper authorization validation in delegated email sending functionality. An authenticated attacker can send specially crafted SOAP requests to impersonate another user and send emails without possessing the required delegation or send-as permissions. This occurs in the SaveDraftRequest SOAP handler.

CWE-863Aug 13, 2026
CVSS3.1v3.1EPSS-PoCs0SignalsSTIX

Zimbra Collaboration SNMP Notification Processing OS Command Injection

A remote code execution vulnerability exists in Zimbra Collaboration (ZCS) before 10.1.20 when the optional zimbra-snmp package is installed and SNMP notifications are enabled. Due to improper sanitization of untrusted input during SNMP notification processing, an unauthenticated attacker can send specially crafted SMTP requests that may result in execution of arbitrary operating system commands as the Zimbra user.

CWE-78Aug 13, 2026
CVSS8.9v3.1EPSS-PoCs0SignalsSTIX

Synacor Zimbra Collaboration Suite (ZCS) Cross-Site Scripting Vulnerability

Zimbra Collaboration (ZCS) 10 before 10.0.18 and 10.1 before 10.1.13 allows Classic UI stored XSS via Cascading Style Sheets (CSS) @import directives in an HTML e-mail message.

CWE-79Jan 5, 2026
CVSS7.2v3.1EPSS22%PoCs0SignalsSTIX

Zimbra Collaboration (ZCS) before 10.1.12 allows SSRF because of the configuration of the chat proxy.

CWE-918Oct 21, 2025
CVSS5.0v3.1EPSS0.244%PoCs0SignalsSTIX

Zimbra GraphQL Cross-Site Request Forgery Information Disclosure Vulnerability

Zimbra GraphQL Cross-Site Request Forgery Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of Zimbra. User interaction is required to exploit this vulnerability in that the target must open a malicious email message. The specific flaw exists within the implementation of the graphql endpoint. The issue results from the lack of proper protections against cross-site request forgery (CSRF) attacks. An attack…

CWE-352Nov 22, 2024
CVSS6.5v3.1EPSS0.465%PoCs0SignalsSTIX

An issue was discovered in Zimbra Collaboration (ZCS) 10.1.x before 10.1.1, 10.0.x before 10.0.9, 9.0.0 before Patch 41, and 8.8.15 before Patch 46. It allows authenticated users to exploit Server-Side Request Forgery (SSRF) due to improper input sanitization and misconfigured domain whitelisting. This issue permits unauthorized HTTP requests to be sent to internal services, which can lead to Remote Code Execution (RCE) by chaining Command Injection within the internal service. When combined wit…

CWE-918Oct 22, 2024
CVSS8.8v3.1EPSS20.2%PoCs0SignalsSTIX

An issue was discovered in Zimbra Collaboration (ZCS) 9.0 and 10.0. The zmmailboxdmgr binary, a component of ZCS, is intended to be executed by the zimbra user with root privileges for specific mailbox operations. However, an attacker can escalate privileges from the zimbra user to root, because of improper handling of input arguments. An attacker can execute arbitrary commands with elevated privileges, leading to local privilege escalation.

CWE-269CWE-755Aug 12, 2024
CVSS7.8v3.1EPSS0.349%PoCs0SignalsSTIX

Zimbra zm-admin-ajax Form Textbox Field Error XFormItem.js XFormItem.prototype.setError cross site scripting

A vulnerability was found in Zimbra zm-admin-ajax up to 8.8.1. It has been classified as problematic. This affects the function XFormItem.prototype.setError of the file WebRoot/js/ajax/dwt/xforms/XFormItem.js of the component Form Textbox Field Error Handler. The manipulation of the argument message leads to cross site scripting. It is possible to initiate the attack remotely. Upgrading to version 8.8.2 is able to address this issue. The identifier of the patch is bb240ce0c71c01caabaa43eed30c78b…

CWE-79Mar 31, 2024
CVSS3.5v3.1EPSS0.466%PoCs0SignalsSTIX

Zimbra zm-ajax XFormItem.js XFormItem.prototype.setError cross site scripting

A vulnerability has been found in Zimbra zm-ajax up to 8.8.1 and classified as problematic. Affected by this vulnerability is the function XFormItem.prototype.setError of the file WebRoot/js/ajax/dwt/xforms/XFormItem.js. The manipulation of the argument message leads to cross site scripting. The attack can be launched remotely. The complexity of an attack is rather high. The exploitation appears to be difficult. Upgrading to version 8.8.2 is able to address this issue. The identifier of the patc…

CWE-79Jan 2, 2024
CVSS2.6v3.1EPSS0.394%PoCs0SignalsSTIX

Zimbra - 'aspell.php' Cross-Site Scripting

Zimbra 2013 has XSS in aspell.php

CWE-79Feb 12, 2020
CVSS6.1v3.1EPSS3.25%PoCs1SignalsSTIX