Skip to main content

Zimbra Collaboration EUVDEUVD-2026-58073

| CVE-2026-73574 LOW
Incorrect Resource Transfer Between Spheres (CWE-669)
2026-08-13 mitre GHSA-79qx-wf73-69v4
Authentication Bypass Collaboration
3.1
CVSS 3.1 · Vendor: mitre

Severity by source

Vendor (mitre) PRIMARY
3.1 LOW
AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N
vuln.today AI
5.3 MEDIUM

Description confirms unauthenticated network access; AC:L because path traversal is straightforward once the endpoint is known; no integrity or availability impact applies.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (mitre).

CVSS VectorVendor: mitre

CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N
Attack Vector
Network
Attack Complexity
High
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
Low
Integrity
None
Availability
None

Lifecycle Timeline

2
Analysis Generated
Aug 13, 2026 - 16:19 vuln.today
Patch available
Aug 13, 2026 - 16:18 EUVD

DescriptionCVE.org

In Zimbra Collaboration before 10.1.17, a local file inclusion (LFI) vulnerability exists in the Zimbra Classic Web Client due to improper validation of the fu request parameter. An unauthenticated attacker can exploit this vulnerability by supplying a crafted path, potentially allowing unauthorized disclosure of protected files, such as WEB-INF/web.xml, within the web application directory. This occurs in the Forward servlet.

AnalysisAI

Local file inclusion in Zimbra Collaboration's Classic Web Client (versions before 10.1.17) exposes protected server-side files via the Forward servlet's unvalidated 'fu' request parameter. An attacker supplying a crafted path can read files such as WEB-INF/web.xml, leaking application configuration including database credentials, internal class mappings, and security settings. …

Unlock full vulnerability intelligence

  • Risk assessment & exploitation conditions
  • Attack chain visualization
  • Remediation with exact patch versions
  • Threat intelligence from 22 sources
  • Personal watchlist & email alerts
Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access
Send HTTP request to Forward servlet
Delivery
Inject path traversal in 'fu' parameter
Exploit
Bypass input validation
Execution
Retrieve WEB-INF/web.xml contents
Persist
Extract embedded credentials or configuration
Impact
Use credentials to access backend systems
Sign in to reveal

Vulnerability AssessmentAI

Exploitation Exploitation requires that the target Zimbra deployment exposes the Classic Web Client (as opposed to the Modern Web Client only) and that the Forward servlet is reachable over the network. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment The official CVSS 3.1 score of 3.1 reflects high attack complexity (AC:H) and low privilege requirement (PR:L), but the description contradicts the PR:L metric by explicitly stating 'unauthenticated attacker' - this inconsistency should be verified with Zimbra's security advisory before making patch prioritization decisions. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario An attacker identifies a Zimbra instance running the Classic Web Client and sends an HTTP request to the Forward servlet with a crafted 'fu' parameter containing a path traversal sequence targeting WEB-INF/web.xml (e.g., '../../WEB-INF/web.xml'). The server returns the contents of the deployment descriptor, revealing database connection strings or internal API keys. …
Remediation The primary fix is upgrading Zimbra Collaboration to version 10.1.17 or later, which the CVE description identifies as the resolved release. … Detailed patch versions, workarounds, and compensating controls in full report.
Sign in to read full assessment

Threat intelligence, references, and detailed analysis are available after sign-in.

More in Collaboration

View all
CVE-2026-73570 HIGH POC
8.9 Aug 13

Remote code execution in Zimbra Collaboration (ZCS) before 10.1.20 enables unauthenticated network attackers to execute

CVE-2022-37393 HIGH POC
7.8 Aug 16

Zimbra's sudo configuration permits the zimbra user to execute the zmslapd binary as root with arbitrary parameters. Rat
CVE-2021-35209 CRITICAL POC
9.8 Jul 02

An issue was discovered in ProxyServlet.java in the /proxy servlet in Zimbra Collaboration Suite 8.8 before 8.8.15 Patch
CVE-2022-41347 HIGH POC
7.8 Sep 26

An issue was discovered in Zimbra Collaboration (ZCS) 8.8.x and 9.x (e.g., 8.8.15). Rated high severity (CVSS 7.8), this
CVE-2024-27443 MEDIUM POC
6.1 Aug 12

An issue was discovered in Zimbra Collaboration (ZCS) 9.0 and 10.0. Rated medium severity (CVSS 6.1), this vulnerability
CVE-2023-29382 CRITICAL
9.8 Jul 06

An issue in Zimbra Collaboration ZCS v.8.8.15 and v.9.0 allows an attacker to execute arbitrary code via the sfdc_preaut
CVE-2023-29381 CRITICAL
9.8 Jul 06

An issue in Zimbra Collaboration (ZCS) v.8.8.15 and v.9.0 allows a remote attacker to escalate privileges and obtain sen
CVE-2022-32294 CRITICAL
9.8 Jul 11

Zimbra Collaboration Open Source 8.8.15 does not encrypt the initial-login randomly created password (from the "zmprove

CVE-2021-35208 MEDIUM POC
5.4 Jul 02

An issue was discovered in ZmMailMsgView.js in the Calendar Invite component in Zimbra Collaboration Suite 8.8.x before

CVE-2024-45518 HIGH
8.8 Oct 22

An issue was discovered in Zimbra Collaboration (ZCS) 10.1.x before 10.1.1, 10.0.x before 10.0.9, 9.0.0 before Patch 41,
CVE-2023-34193 HIGH
8.8 Jul 06

File Upload vulnerability in Zimbra ZCS 8.8.15 allows an authenticated privileged user to execute arbitrary code and obt
CVE-2024-27442 HIGH
7.8 Aug 12

An issue was discovered in Zimbra Collaboration (ZCS) 9.0 and 10.0. Rated high severity (CVSS 7.8), this vulnerability i

Same weakness CWE-669 – Incorrect Resource Transfer Between Spheres

View all
CVE-2026-31431 HIGH POC
7.8
CVE-2020-1048 HIGH POC
7.8
CVE-2020-5800 CRITICAL POC
9.8
CVE-2020-15892 CRITICAL POC
9.8
CVE-2026-25253 HIGH POC
8.8
CVE-2020-25917 HIGH POC
8.8
CVE-2019-13266 HIGH POC
8.8
CVE-2019-13263 HIGH POC
8.8

Same technique Authentication Bypass

View all
CVE-2023-22515 CRITICAL POC
9.8
CVE-2012-4681 CRITICAL POC
9.8
CVE-2013-2465 CRITICAL POC
9.8
CVE-2011-3544 CRITICAL POC
9.8
CVE-2022-40684 CRITICAL POC
9.8
CVE-2025-61882 CRITICAL POC
9.8
CVE-2024-0012 CRITICAL POC
9.3
CVE-2023-46805 HIGH POC
8.2

Share

EUVD-2026-58073 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy