Zimbra Fixes Two Stored XSS Flaws Triggered by Malicious Emails

CERT Polska disclosed two stored cross-site scripting vulnerabilities in Synacor Zimbra Collaboration versions before 10.1.21. Both flaws allow malicious email content to execute JavaScript in a recipient’s webmail context, potentially exposing session information or enabling actions on the victim’s behalf. A CERT Polska employee discovered the vulnerabilities and helped coordinate disclosure; both are fixed in version 10.1.21.

CVE-2026-66911 lets an unauthenticated remote attacker inject JavaScript through an attachment’s Content-Location MIME header; execution requires the recipient to open the email in the web interface and click the attachment name. CVE-2026-66912 uses the From header and triggers when a recipient replies in the Classic UI with HTML composition enabled and reply headers disabled. Administrators should upgrade affected deployments to version 10.1.21 or later. The supplied reports do not establish active exploitation or provide severity scores.