Zimbra Collaboration Suite EUVD-2026-108973

The attacker must be an authenticated ZCS user who has Briefcase access and can publish/share documents. The crafted document must be stored as content type application/x-zimbra-doc and contain a stylesheet with non-ASCII characters, which triggers DefangFilter to append the final ASCII segment without sanitizing, preserving CSS URL references (e.g., loading external resources and rendering a spoofed credential form under the Zimbra origin). Exploitation requires the victim to open the shared document in a browser that renders this content type inline (UI:R); credential theft additionally requires the victim to submit the displayed form - a second interaction step. These factors (prior authentication, required victim interaction, and the extra form-submission step for the worst outcome) limit realistic impact below the raw network-reachable appearance. Affected per description: ZCS 10.1.16 and 10.1.20 (EUVD: versions ≤ 10.1.20).

This is a medium-severity (CVSS 5.4) stored cross-site-scripting/content-spoofing issue whose real-world risk is moderate rather than critical, and the signals are internally consistent rather than conflicting. The CVSS vector (AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N) shows the network reach is real but gated by three meaningful constraints: the attacker must already be an authenticated ZCS user with Briefcase access (PR:L), the victim must open the shared document (UI:R), and for actual credential theft the victim must additionally submit the spoofed form - a step beyond the scored impact. The scope change (S:C) is the notable part: content executes under the trusted Zimbra origin, which is what makes the credential-harvesting form convincing. No EPSS score and no CISA KEV entry are provided, so there is no evidence of active or automated exploitation; the vuln.today Decision label is 'this_month', not 'act_now' or 'emergency', aligning with a plan-and-patch posture rather than drop-everything urgency. Rapid7 reported and published research on this flaw, which raises the likelihood that technical detail is public, but the input does not confirm working exploit code. Net: treat this as a credible internal phishing/credential-harvesting escalation primitive under a trusted origin - a real priority to patch on a normal cycle - not a mass-exploitable, unauthenticated RCE.

An authenticated Zimbra user with Briefcase access crafts a document whose stylesheet contains non-ASCII characters so that DefangFilter appends the final ASCII segment unsanitized, preserving CSS URL references that the normal sanitizer would strip; the document is stored as application/x-zimbra-doc and shared. When a colleague opens it inline in a browser, it renders a credential-collection form using Zimbra's own visual assets under the legitimate Zimbra origin, and credentials entered by the victim are exfiltrated. Rapid7 has published research describing the technique, but the input does not confirm verified working exploit code.