CISA KEV catalog
Confirmed active exploitation.
Listed in CISA's catalog of Known Exploited Vulnerabilities: attackers are using it in real attacks. Patch it with priority.
- Name
- Synacor Zimbra Collaboration Suite (ZCS) Arbitrary File Upload Vulnerability
- Added to catalog
- Remediation due date (US federal)
- Required action
- Apply updates per vendor instructions.
Description
An issue was discovered in Zimbra Collaboration (ZCS) 8.8.15 and 9.0. An attacker can upload arbitrary files through amavis via a cpio loophole (extraction to /opt/zimbra/jetty/webapps/zimbra/public) that can lead to incorrect access to any other user accounts. Zimbra recommends pax over cpio. Also, pax is in the prerequisites of Zimbra on Ubuntu; however, pax is no longer part of a default Red Hat installation after RHEL 6 (or CentOS 6). Once pax is installed, amavis automatically prefers it over cpio.
Affected products
synacor: zimbra collaboration suite
References10
- forums.zimbra.org/viewtopic.php?t=71153&p=306532 MitigationVendor Advisory
- wiki.zimbra.com/wiki/Security_Center PatchRelease NotesVendor Advisory
- wiki.zimbra.com/wiki/Zimbra_Security_Advisories Vendor Advisory
- forums.zimbra.org/viewtopic.php?t=71153&p=306532 MitigationVendor Advisory
- wiki.zimbra.com/wiki/Security_Center PatchRelease NotesVendor Advisory
- wiki.zimbra.com/wiki/Zimbra_Security_Advisories Vendor Advisory
- packetstormsecurity.com/files/169458/Zimbra-Collaboration-Suite… ExploitThird Party AdvisoryVDB Entry
- packetstormsecurity.com/files/169458/Zimbra-Collaboration-Suite… ExploitThird Party AdvisoryVDB Entry
- www.secpod.com/blog/unpatched-rce-bug-in-zimbra-collaboration-s… Third Party Advisory
- www.secpod.com/blog/unpatched-rce-bug-in-zimbra-collaboration-s… Third Party Advisory
Metrics
- CVSS 3.1
-
9.8
CRITICAL
Score source: NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - EPSS — exploit probability
- 95% percentile: 100 · as of 2 November 2026
- CWE
- CWE-22