EUVD-2026-58072
GHSA-rwrq-wv6j-q425
Severity by source
AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N
Network-accessible endpoint requires authenticated session (PR:L) with high-complexity prerequisites (AC:H); impact is read-only and limited to partial file disclosure with no integrity or availability effect.
Primary rating from Vendor (mitre).
CVSS VectorVendor: mitre
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N
Lifecycle Timeline
2DescriptionCVE.org
In Zimbra Collaboration (ZCS) before 10.1.17, a path traversal vulnerability exists in the Zimbra Briefcase document editing functionality due to improper validation of the packages parameter. An authenticated attacker can exploit this vulnerability by supplying a crafted path traversal sequence, potentially allowing unauthorized disclosure of sensitive files within the web application directory.
AnalysisAI
Path traversal in Zimbra Collaboration Suite (ZCS) Briefcase document editing exposes sensitive web application files to authenticated low-privileged users. The vulnerability stems from improper validation of the packages parameter, enabling directory escape via crafted traversal sequences. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires a valid authenticated Zimbra Collaboration account with at minimum low-level user privileges (PR:L per CVSS vector) - anonymous or unauthenticated access is not sufficient. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 score of 3.1 (Low) is consistent with the constrained impact profile: AC:H indicates exploitation is not straightforward and likely requires specific server-side conditions or multi-step interaction beyond simple parameter injection; PR:L mandates a valid authenticated session, ruling out anonymous mass exploitation; and the impact triad of C:L/I:N/A:N means successful exploitation yields only limited file read capability with no write or denial-of-service effect. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker with a valid low-privileged Zimbra account authenticates to the ZCS web interface and submits a crafted HTTP request to the Briefcase document editing endpoint, supplying a traversal sequence such as `../../../../etc/zimbra/localconfig.xml` in the `packages` parameter. If the high-complexity condition is satisfied - the precise nature of which is not detailed in available sources - the server returns file contents from outside the intended Briefcase directory, potentially disclosing configuration data or internal path structure. … |
| Remediation | Upgrade Zimbra Collaboration Suite to version 10.1.17 or later, which contains the vendor-released patch per the advisory at https://wiki.zimbra.com/wiki/Zimbra_Security_Advisories. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Collaboration
View allRemote code execution in Zimbra Collaboration (ZCS) before 10.1.20 enables unauthenticated network attackers to execute
Zimbra's sudo configuration permits the zimbra user to execute the zmslapd binary as root with arbitrary parameters. Rat
An issue was discovered in ProxyServlet.java in the /proxy servlet in Zimbra Collaboration Suite 8.8 before 8.8.15 Patch
An issue was discovered in Zimbra Collaboration (ZCS) 8.8.x and 9.x (e.g., 8.8.15). Rated high severity (CVSS 7.8), this
An issue was discovered in Zimbra Collaboration (ZCS) 9.0 and 10.0. Rated medium severity (CVSS 6.1), this vulnerability
An issue in Zimbra Collaboration ZCS v.8.8.15 and v.9.0 allows an attacker to execute arbitrary code via the sfdc_preaut
An issue in Zimbra Collaboration (ZCS) v.8.8.15 and v.9.0 allows a remote attacker to escalate privileges and obtain sen
Zimbra Collaboration Open Source 8.8.15 does not encrypt the initial-login randomly created password (from the "zmprove
An issue was discovered in ZmMailMsgView.js in the Calendar Invite component in Zimbra Collaboration Suite 8.8.x before
An issue was discovered in Zimbra Collaboration (ZCS) 10.1.x before 10.1.1, 10.0.x before 10.0.9, 9.0.0 before Patch 41,
File Upload vulnerability in Zimbra ZCS 8.8.15 allows an authenticated privileged user to execute arbitrary code and obt
An issue was discovered in Zimbra Collaboration (ZCS) 9.0 and 10.0. Rated high severity (CVSS 7.8), this vulnerability i
Same weakness CWE-24 – Path Traversal: '../filedir'
View allSame technique Path Traversal
View allShare
External POC / Exploit Code
Leaving vuln.today