Zimbra Collaboration CVE-2025-68645

Exploitation requires that the target run the Zimbra Collaboration (ZCS) 10.0 or 10.1 Webmail Classic UI with the /h/rest endpoint reachable (typically the internet-facing webmail interface); the flaw lies in the RestFilter servlet's handling of user-supplied request parameters that influence internal request dispatching, enabling inclusion of files under the WebRoot directory. Per the description no authentication is needed (PR:N), which limits the barrier to entry to merely network reachability of the Classic UI. A potential limiting factor is the input vector's UI:R, which would imply a victim action is needed, but the description does not describe any user-interaction requirement and instead states the attacker crafts the requests directly - this discrepancy should be resolved with the vendor. Only the Classic UI is implicated; deployments using a different webmail interface may not expose the vulnerable servlet.

This is a genuine top-priority vulnerability, with multiple independent signals aligning rather than conflicting. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R) describes a network-reachable, low-complexity flaw requiring no privileges, and the description explicitly states an unauthenticated remote attacker can exploit it. CISA KEV confirms active exploitation in the wild, and the vuln.today decision label is act_now - so this must be treated as an emergency, not a 'patch soon' item. EPSS is 48.87% at the 99th percentile, which is exceptionally high and corroborates the KEV listing (here EPSS and KEV agree, indicating broad rather than purely targeted exploitation). One internal tension: the input CVSS vector carries UI:R (user interaction required), yet the description says the attacker 'can craft requests' to the endpoint with no mention of a victim action - these conflict, and the true need for user interaction should be verified with Zimbra. Impact metrics in the input (C:H/I:H/A:H) also appear inflated for what the description frames as file inclusion / information disclosure; confidentiality impact is clearly high, but integrity/availability impact is not substantiated by the described behavior and should be verified.

A remote attacker with no credentials sends crafted requests to the Zimbra Webmail Classic UI /h/rest endpoint, manipulating the RestFilter servlet's internal request dispatching to include and read arbitrary files from the WebRoot directory (e.g., configuration or credential-bearing files). This is confirmed actively exploited per CISA KEV; no public PoC is listed among the references, but the KEV status establishes working real-world exploitation.