Zimbra Collaboration Suite EUVD-2026-108971

Exploitation requires: (1) the recipient to use the Zimbra Classic web client (not Modern), open the attacker's crafted email, and manually submit the embedded form; (2) the form-action to use a percent-encoded hostname that defeats the pre-canonicalization hostname comparison in DefangFilter and the OWASP ActionAttributePolicy; and (3) for any state-changing effect, a target Zimbra endpoint that accepts the resulting authenticated request WITHOUT CSRF-token validation - the flaw explicitly does not bypass CSRF tokens on its own. Limiting factors that reduce realistic risk: mandatory user interaction (open plus explicit form submission in Classic), dependence on a CSRF-token-unprotected endpoint, and the affected versions being ZCS 10.1.16 and 10.1.21.

This is a medium-severity (CVSS 4.3) input-validation/order-of-operations flaw (CWE-180, validate-before-canonicalize). The CVSS vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N shows a network-reachable, low-complexity bypass requiring no attacker privileges (PR:N - the sender is unauthenticated) but mandatory victim interaction (UI:R) and yielding only limited integrity impact (I:L; no confidentiality or availability impact). The vuln.today Decision label is this_month, not act_now/emergency, which aligns with the modest score. No EPSS probability, no CISA KEV listing, and no confirmed working exploit are present in the input, so there is no signal of active or widespread exploitation - a Rapid7 research blog by the reporter describes the technique, but the input does not mark it as confirmed working exploit code. Crucially, the flaw does NOT by itself produce a state change: the description states it does not bypass CSRF-token checks, so a real attack additionally requires a target endpoint that accepts the request without CSRF protection, further reducing real-world risk. Net: a legitimate patch-this-month item for Zimbra operators rather than an emergency. Note a data conflict: the description says the issue is present in ZCS 10.1.21, while EUVD lists affected as '0 < 10.1.21' (implying 10.1.21 is fixed) - verify the exact fixed build with the vendor.

An unauthenticated attacker emails a victim an HTML message containing a form whose action targets the Zimbra host via a percent-encoded hostname that survives DefangFilter and the OWASP ActionAttributePolicy (which compare hostnames before browser URL canonicalization). When the recipient opens the message in the Classic web client and submits the form, the browser canonicalizes the URL and posts to the normal Zimbra origin carrying the victim's authentication cookie. Rapid7 documented the technique; no verified working exploit code is confirmed in the input, and achieving an actual state-changing action still requires an endpoint that does not enforce CSRF-token checks.