EUVD-2026-58071
GHSA-4644-7rc8-9cw4
Severity by source
AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Network delivery via email (AV:N), no attacker account needed (PR:N), user must preview attachment (UI:R), script crosses session boundary (S:C), with limited read/write impact on victim session and no availability impact.
Primary rating from Vendor (mitre).
CVSS VectorVendor: mitre
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Lifecycle Timeline
3DescriptionCVE.org
In Zimbra Collaboration (ZCS) before 10.1.17, a stored cross-site scripting (XSS) vulnerability exists in the Zimbra Classic Web Client due to insufficient sanitization of specific attachment content during inline preview. An attacker can send a crafted email containing a malicious attachment that, when previewed by a user, executes arbitrary JavaScript within the victim's browser session. Successful exploitation may allow an attacker to perform unauthorized actions on behalf of the victim user, potentially leading to data exfiltration or unauthorized access to sensitive information.
AnalysisAI
Stored XSS in Zimbra Collaboration Classic Web Client before 10.1.17 enables remote, unauthenticated attackers to deliver malicious JavaScript via crafted email attachments, which executes in the victim's browser session upon inline preview. Affected organizations running ZCS versions prior to 10.1.17 are exposed to session hijacking, unauthorized webmail actions, and data exfiltration without the attacker needing any account on the target system. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires that the victim is using the Zimbra Classic Web Client (not the Modern Web Client) and that the victim previews the malicious attachment inline rather than downloading it. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 6.1 Medium score reflects a network-accessible (AV:N), low-complexity (AC:L), no-privileges-required (PR:N) attack with changed scope (S:C) and limited confidentiality and integrity impact (C:L/I:L). … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker crafts an email containing an attachment - such as an HTML or SVG file - with embedded JavaScript and sends it to a target Zimbra user. When the victim opens the email and previews the attachment inline within the Classic Web Client, the malicious script executes in the victim's authenticated browser session. … |
| Remediation | The primary remediation is to upgrade Zimbra Collaboration to version 10.1.17 or later, which resolves the insufficient attachment sanitization. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Collaboration
View allRemote code execution in Zimbra Collaboration (ZCS) before 10.1.20 enables unauthenticated network attackers to execute
Zimbra's sudo configuration permits the zimbra user to execute the zmslapd binary as root with arbitrary parameters. Rat
An issue was discovered in ProxyServlet.java in the /proxy servlet in Zimbra Collaboration Suite 8.8 before 8.8.15 Patch
An issue was discovered in Zimbra Collaboration (ZCS) 8.8.x and 9.x (e.g., 8.8.15). Rated high severity (CVSS 7.8), this
An issue was discovered in Zimbra Collaboration (ZCS) 9.0 and 10.0. Rated medium severity (CVSS 6.1), this vulnerability
An issue in Zimbra Collaboration ZCS v.8.8.15 and v.9.0 allows an attacker to execute arbitrary code via the sfdc_preaut
An issue in Zimbra Collaboration (ZCS) v.8.8.15 and v.9.0 allows a remote attacker to escalate privileges and obtain sen
Zimbra Collaboration Open Source 8.8.15 does not encrypt the initial-login randomly created password (from the "zmprove
An issue was discovered in ZmMailMsgView.js in the Calendar Invite component in Zimbra Collaboration Suite 8.8.x before
An issue was discovered in Zimbra Collaboration (ZCS) 10.1.x before 10.1.1, 10.0.x before 10.0.9, 9.0.0 before Patch 41,
File Upload vulnerability in Zimbra ZCS 8.8.15 allows an authenticated privileged user to execute arbitrary code and obt
An issue was discovered in Zimbra Collaboration (ZCS) 9.0 and 10.0. Rated high severity (CVSS 7.8), this vulnerability i
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today