Loading story…
A high-severity Local File Inclusion (LFI) vulnerability has been identified in the Webmail Classic UI of Zimbra Collaboration Suite (ZCS) versions 10.0 and 10.1. The flaw, tracked as CVE-2025-68645, arises from improper handling of user-supplied request parameters in the RestFilter servlet, allowing unauthenticated remote attackers to craft requests to the /h/rest endpoint and include arbitrary files from the WebRoot directory. This vulnerability exposes internal files to attackers, potentially leading to the disclosure of sensitive information and further compromise of affected Zimbra installations.
Security researchers have highlighted the risk that this LFI vulnerability poses, as it can be exploited without authentication and may serve as a stepping stone for more advanced attacks. Organizations using Zimbra Collaboration Suite are urged to review their deployments and apply any available patches or mitigations to prevent exploitation. The vulnerability has been assigned a CVSS 3.1 score of 8.8, reflecting its high impact and ease of exploitation.
See affected versions and whether adversaries are exploiting it.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Zimbra has urged customers to upgrade to **Zimbra Collaboration 10.1.19** to remediate a critical stored cross-site scripting flaw in the **Classic Web Client**. The vulnerability, which does not yet have a CVE identifier, can be triggered through a specially crafted email and may execute malicious code when a user opens the message in the Classic UI. Successful exploitation could expose **session data, account settings, and mailbox contents**, creating a direct path to account compromise and data theft. The issue was reported by **Google Threat Analysis Group**, and Zimbra said it has **no evidence of active exploitation** so far. The warning has drawn added attention because Zimbra products have been repeatedly targeted in recent years by Russian state-linked groups including **Winter Vivern**, **APT29**, and **APT28**, while other Zimbra flaws have also appeared in **CISA KEV** and been used in campaigns against government, military, and Ukrainian entities.
Jul 23, 2026
Zimbra disclosed security updates for Zimbra Collaboration Suite (ZCS) Daffodil releases before `10.1.21`, addressing vulnerabilities that include **CVE-2026-93643**, a critical unauthenticated path-traversal flaw in the OnlyOffice/Document Editing integration. An attacker able to access an existing supported public Briefcase document can abuse unsigned save fields in a `/downloadas` request to write files through path traversal and execute commands as the `zimbra` user; the flaw is rated CVSS 9.8. Canadian and Guyanese national cyber authorities urged administrators to review Zimbra’s release information and apply the available update. Two additional unauthenticated stored XSS vulnerabilities, **CVE-2026-93642** and **CVE-2026-93647**, can let attackers execute script in authenticated users’ browsers and access mailbox data or act as those users. The first uses a forged share invitation accepted in Zimbra Modern, while the second embeds active markup in the `From` field of a calendar `COUNTER` message viewed in the Classic client. Rapid7 warned that weaknesses across Zimbra mail, document, and calendar functions can support business email compromise campaigns that manipulate the records employees use for decisions, creating coordinated fraudulent communications and complicating forensic investigation.
Sep 29, 2026
CISA added **CVE-2025-66376** to its Known Exploited Vulnerabilities catalog after reports of active exploitation against **Zimbra Collaboration Suite**. The high-severity flaw affects the **Classic UI** and lets an unauthenticated remote attacker trigger **stored/persistent XSS** by sending malicious HTML email that abuses the CSS `@import` directive, potentially exposing sensitive information and creating a path to further compromise. The vulnerability affects Zimbra Collaboration Suite versions earlier than **10.0.18** and **10.1.13**. Synacor patched the issue in November 2025, and Zimbra security advisories list the fixed releases; organizations running vulnerable versions have been urged to upgrade immediately to **10.0.18**, **10.1.13**, or later because the flaw is already being exploited in the wild.
Jul 24, 2026