EUVD-2025-18891Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessSend crafted email with XSS payload
-
DeliveryVictim opens email in Classic UI
-
ExploitScript executes in victim's browser
-
ExecutionAttacker steals session cookies
-
PersistAttacker impersonates victim
-
ImpactUnauthorized access to sensitive data
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Output encoding, context-aware escaping
MITRE ATT&CK
2 techniques across 2 tactics: Initial Access, Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | The victim must use the Zimbra Classic UI to view a crafted email. No special configuration required beyond default settings. User interaction is required (viewing the email), but no additional clicks or actions. The attack is unauthenticated (attacker sends email without authentication) but requires the victim to have a valid session. |
| Impact | Real-world risk is high due to active exploitation (CISA KEV) and public exploit availability. CVSS 6.1 (Medium) reflects low confidentiality and integrity impact with user interaction required, but the KEV listing and EPSS score of 0.04% (12th percentile) indicate targeted exploitation. SSVC decision: exploitation status 'active', automatable, technical impact partial. Despite medium CVSS, active exploitation elevates priority. |
| Exploit ScenarioDerived | An attacker sends a crafted email containing malicious HTML/JavaScript to a Zimbra user. When the user views the email in the Classic UI, the script executes in the user's session, potentially stealing cookies or performing actions on behalf of the user. Public exploit code exists, lowering the barrier to attack. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv2 – Jul 26, 2026
Cross-site scripting in Zimbra Collaboration (ZCS) Classic UI allows attackers to execute arbitrary JavaScript within a user's session by sending a crafted email. Actively exploited in the wild (CISA KEV) with public exploit code available, affecting versions 8.8.15, 9.0, 10.0, and 10.1.
Earlier versions of this analysis (1)
RemediationAI
Upgrade to a patched version as per Zimbra Security Advisories (https://wiki.zimbra.com/wiki/Zimbra_Security_Advisories). No specific fix version listed; apply latest patches. Workaround: Disable HTML email rendering in Classic UI or use Zimbra Web Client Modern UI if available. Note: disabling HTML may impact user experience.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability is a stored cross-site scripting (XSS) issue (CWE-79) in the Zimbra Classic UI, part of Zimbra Collaboration Suite (ZCS). The flaw stems from insufficient sanitization of HTML content in email messages, allowing crafted tag structures and attribute values with @import directives to inject scripts. CPE data confirms affected versions include 8.8.15 and various patch levels, as well as 9.0, 10.0, and 10.1.
Know when Zimbra Collaboration Suite gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Network attack vector, low complexity, no privileges, user interaction required, scope changed, low CIA.
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
2DescriptionCVE.org
An issue was discovered in Zimbra Collaboration (ZCS) 8.8.15 and 9.0 and 10.0 and 10.1. A Cross-Site Scripting (XSS) vulnerability in the Zimbra Classic UI allows attackers to execute arbitrary JavaScript within the user's session, potentially leading to unauthorized access to sensitive information. This issue arises from insufficient sanitization of HTML content, specifically involving crafted tag structures and attribute values that include an @import directive and other script injection vectors. The vulnerability is triggered when a user views a crafted e-mail message in the Classic UI, requiring no additional user interaction.
Executive ViewAI
CVE-2025-48700 presents moderate security risk, a cross-site scripting vulnerability rated CVSS 6.1. Attackers could inject scripts to steal sessions or perform actions as authenticated users. Organizations should apply vendor updates when available and monitor for exploitation.
Apply vendor patch. If patching is delayed: implement CSP headers, enable HttpOnly cookies, deploy WAF XSS rules.
Threat Intelligence Overview
NVD
CVE.org
CISA KEV
EPSS
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Cross-Site Scripting occurs when an application accepts untrusted data and sends it to a web browser without proper validation or encoding.
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
More in Zimbra Collaboration Suite
View allAn issue was discovered in Zimbra Collaboration (ZCS) 8.8.15 and 9.0. Rated critical severity (CVSS 9.8), this vulnerabi
Zimbra Collaboration Suite (ZCS) 8.8.15 and 9.0 has mboximport functionality that receives a ZIP archive and extracts fi
Zimbra Collaboration (aka ZCS) 8.8.15 and 9.0 has mboximport functionality that receives a ZIP archive and extracts file
Zimbra Collaboration (aka ZCS) 8.8.15 and 9.0 allows an unauthenticated attacker to inject arbitrary memcache commands i
Directory traversal vulnerability in /res/I18nMsg,AjxMsg,ZMsg,ZmMsg,AjxKeys,ZmKeys,ZdMsg,Ajx%20TemplateMsg.js.zgz in Zim
Cross-site scripting (XSS) vulnerability in the ZmMailMsgView.getAttachmentLinkHtml function in Zimbra Collaboration Sui
An issue was discovered in Zimbra Collaboration (ZCS) 9.0 and 10.0 and 10.1. Rated medium severity (CVSS 5.4), this vuln
Zimbra Collaboration Suite (ZCS) 10.x contains a stored XSS vulnerability in the Classic UI that allows attackers to exe
Due to an issue with incorrect sudo permissions, Zimbra Collaboration Suite (ZCS) suffers from a local privilege escalat
Zimbra Collaboration Suite before 8.6 patch 13, 8.7.x before 8.7.11 patch 10, and 8.8.x before 8.8.10 patch 7 or 8.8.x b
The postjournal service in Zimbra Collaboration (ZCS) before 8.8.15 Patch 46, 9 before 9.0.0 Patch 41, 10 before 10.0.9,
Zimbra Collaboration Suite (ZCS) before 8.8.15 Patch 7 allows SSRF when WebEx zimlet is installed and zimlet JSP is enab
GitHub PoC
Exploit-DB