Description
When OnlyOffice/Document Editing is available, an unauthenticated remote attacker with access to an existing supported public Briefcase document can abuse unsigned save fields to perform path-traversal writes and execute commands as zimbra.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Zimbra | Zimbra Collaboration Suite (ZCS) | < 10.1.21 | 10.1.21 |
Advisories 1
- WID-SEC-2026-3593 Synacor Zimbra: Mehrere Schwachstellen BSI CERT-Bund (WID) · Oct 29, 2026
References
- https://wiki.zimbra.com/wiki/Zimbra_Security_Advisories vendor-advisory