What’s Vulnerable › Vulnerabilities

CVE-2022-41352: Synacor Zimbra Collaboration Suite (ZCS) Arbitrary File Upload Vulnerability

• Severity: critical (CVSS 9.8 v3.1)
• Exploited in the wild: yes — in CISA KEV since 2022-10-20
• EPSS: 95.5% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2022-09-26 · updated 2026-09-10
• Weakness: CWE-22

Description

An issue was discovered in Zimbra Collaboration (ZCS) 8.8.15 and 9.0. An attacker can upload arbitrary files through amavis via a cpio loophole (extraction to /opt/zimbra/jetty/webapps/zimbra/public) that can lead to incorrect access to any other user accounts. Zimbra recommends pax over cpio. Also, pax is in the prerequisites of Zimbra on Ubuntu; however, pax is no longer part of a default Red Hat installation after RHEL 6 (or CentOS 6). Once pax is installed, amavis automatically prefers it over cpio.

Summary

CVE-2022-41352 is a critical (CVSS 9.8) arbitrary file upload flaw in Synacor Zimbra Collaboration Suite 8.8.15 and 9.0, where an attacker can upload files through amavis via a cpio loophole, potentially leading to access to other user accounts. It is listed in CISA's Known Exploited Vulnerabilities catalog with active exploitation, a public exploit exists, and EPSS estimates a 95.5% probability of exploitation in 30 days. Apply updates per vendor instructions; Zimbra recommends using pax instead of cpio, and once pax is installed amavis automatically prefers it over cpio (note pax is not part of default Red Hat installations after RHEL 6/CentOS 6).

CVE-2022-41352 ثغرة حرجة (CVSS 9.8) لتحميل ملفات عشوائية في Synacor Zimbra Collaboration Suite 8.8.15 و9.0، حيث يمكن للمهاجم تحميل ملفات عبر amavis من خلال ثغرة cpio، ما قد يؤدي إلى وصول غير صحيح إلى حسابات مستخدمين آخرين. الثغرة مدرجة في كتالوج CISA للثغرات المعروفة المستغلة مع استغلال نشط، ويوجد استغلال عام، وتقدّر EPSS احتمال الاستغلال خلال 30 يوماً بنسبة 95.5%. طبّق التحديثات وفق تعليمات المورّد؛ وتوصي Zimbra باستخدام pax بدلاً من cpio، وبمجرد تثبيت pax يفضّله amavis تلقائياً على cpio (علماً أن pax لم يعد جزءاً من تثبيت Red Hat الافتراضي بعد RHEL 6/CentOS 6).

Affected products

• Zimbra Collaboration: 9.0.0, 9.0.0-p1, 9.0.0-p10, 9.0.0-p11, 9.0.0-p12, 9.0.0-p13 (+57)

References

• http://packetstormsecurity.com/files/169458/Zimbra-Collaboration-Suite-TAR-Path-Traversal.html
• https://forums.zimbra.org/viewtopic.php?t=71153&p=306532
• https://wiki.zimbra.com/wiki/Security_Center
• https://wiki.zimbra.com/wiki/Zimbra_Security_Advisories
• https://www.secpod.com/blog/unpatched-rce-bug-in-zimbra-collaboration-suite-exploited-in-wild/
• http://packetstormsecurity.com/files/169458/Zimbra-Collaboration-Suite-TAR-Path-Traversal.html
• https://forums.zimbra.org/viewtopic.php?t=71153&p=306532
• https://wiki.zimbra.com/wiki/Security_Center
• https://wiki.zimbra.com/wiki/Zimbra_Security_Advisories
• https://www.secpod.com/blog/unpatched-rce-bug-in-zimbra-collaboration-suite-exploited-in-wild/
• https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2022-41352

Get alerted when CVE-2022-41352 or the next vulnerability affects your stack