Description
Zimbra before 8.8.15 Patch 10 and 9.x before 9.0.0 Patch 3 allows remote code execution via an avatar file. There is potential abuse of /service/upload servlet in the webmail subsystem. A user can upload executable files (exe,sh,bat,jar) in the Contact section of the mailbox as an avatar image for a contact. A user will receive a "Corrupt File" error, but the file is still uploaded and stored locally in /opt/zimbra/data/tmp/upload/, leaving it open to possible remote execution.
References (3)
Core 3
Core References
Vendor Advisory x_refsource_misc
https://wiki.zimbra.com/wiki/Zimbra_Security_Advisories
Release Notes, Vendor Advisory x_refsource_misc
https://wiki.zimbra.com/wiki/Security_Center
Vendor Advisory x_refsource_confirm
https://wiki.zimbra.com/wiki/Zimbra_Releases/9.0.0/P3
Scores
CVSS v3
8.0
EPSS
0.0588
EPSS Percentile
90.6%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
Details
CWE
CWE-434
Status
published
Products (3)
synacor/zimbra_collaboration_suite
8.8.15 (10 CPE variants)
synacor/zimbra_collaboration_suite
9.0.0 (3 CPE variants)
synacor/zimbra_collaboration_suite
< 8.8.15
Published
Jun 03, 2020
Tracked Since
Feb 18, 2026