Skip to content
OpenAdvisories
High WID-SEC-2026-3593 6 CVEs

Synacor Zimbra: Mehrere Schwachstellen

Published Sep 27, 2026 · Updated Oct 29, 2026 · Revision 2 · de-DE

Vendor: Synacor Product: Zimbra

Summary

Ein Angreifer kann mehrere Schwachstellen in Synacor Zimbra ausnutzen, um Cross-Site-Scripting-Angriffe durchzuführen, Sicherheitsmaßnahmen zu umgehen, beliebigen Code auszuführen, Daten zu manipulieren oder offenzulegen oder andere, nicht näher spezifizierte Angriffe durchzuführen.

Product

Zimbra ist eine Groupware-Lösung, die E-Mail, Kalender und Aufgabenverwaltung bietet.

Vulnerabilities 6

  • Critical 9.8
    CVE-2026-93643

    Zimbra Collaboration Suite OnlyOffice Integration Path Traversal Leading to Remote Code Execution via Unauthenticated /downloadas Request

    When OnlyOffice/Document Editing is available, an unauthenticated remote attacker with access to an existing supported public Briefcase document can abuse unsigned save fields to perform path-traversal writes and execute commands as zimbra.

    Zimbra Zimbra Collaboration Suite (ZCS)
  • Critical 9.3
    CVE-2026-93641

    Zimbra Collaboration Suite Classic Web Client Stored Cross-Site Scripting via Forged Share Invitation

    An unauthenticated sender can forge a share notification that triggers stored XSS when a signed-in Zimbra Classic recipient clicks Accept Share, allowing the attacker to access mailbox data and act as the victim.

    Zimbra Zimbra Collaboration Suite (ZCS)
  • Critical 9.3
    CVE-2026-93642

    Zimbra Collaboration Suite Modern Web Client Stored Cross-Site Scripting via Forged Share Invitation

    An unauthenticated sender can forge a share notification that triggers stored XSS when a signed-in Zimbra Modern recipient clicks Accept Share, allowing the attacker to access mailbox data and act as the victim.

    Zimbra Zimbra Collaboration Suite (ZCS)
  • Critical 9.3
    CVE-2026-93647

    Zimbra Collaboration Suite Classic Web Client Stored Cross-Site Scripting via Crafted Calendar COUNTER Message From Address

    An unauthenticated calendar sender can place active markup in a COUNTER message's RFC From address. Selecting the message in Zimbra Classic triggers stored XSS, allowing the attacker to access mailbox data and act as the victim.

    Zimbra Zimbra Collaboration Suite (ZCS)
  • Medium 5.3
    CVE-2026-66911

    Stored Cross-Site Scripting in Zimbra

    Zimbra is vulnerable to stored cross-site scripting (XSS) via the Content-Location MIME header in email attachments. Due to lack of sanitization of the Content-Location header, an attacker can set it to a javascript: URI. An unauthenticated remote attacker ca…

    Synacor Zimbra Collaboration
  • Medium 5.3
    CVE-2026-66912

    Stored Cross-Site Scripting in Zimbra

    Zimbra is vulnerable to Stored Cross-Site Scripting (XSS) via the From email header during HTML reply composition in Classic UI. Due to insufficient sanitization of the From header value, a remote attacker can send a crafted email containing a malicious From …

    Synacor Zimbra Collaboration

Revision history

  1. #2

    Referenz(en) aufgenommen: EUVD-2026-112941, EUVD-2026-112942

  2. #1

    Initiale Fassung

References