What’s Vulnerable › Vulnerabilities
CVE-2025-27915: Synacor Zimbra Collaboration Suite (ZCS) Cross-site Scripting Vulnerability
- Severity: medium (CVSS 5.4 v3.1)
- Exploited in the wild: yes — in CISA KEV since 2025-10-07
- EPSS: 4.1% probability of exploitation in the next 30 days
- Public exploit or detection template: yes
- Published: 2025-03-12 · updated 2026-06-17
- Weakness: CWE-79
Description
An issue was discovered in Zimbra Collaboration (ZCS) 9.0 and 10.0 and 10.1. A stored cross-site scripting (XSS) vulnerability exists in the Classic Web Client due to insufficient sanitization of HTML content in ICS files. When a user views an e-mail message containing a malicious ICS entry, its embedded JavaScript executes via an ontoggle event inside a <details> tag. This allows an attacker to run arbitrary JavaScript within the victim's session, potentially leading to unauthorized actions such as setting e-mail filters to redirect messages to an attacker-controlled address. As a result, an attacker can perform unauthorized actions on the victim's account, including e-mail redirection and data exfiltration.
Summary
A stored cross-site scripting (XSS) flaw in the Classic Web Client of Synacor Zimbra Collaboration Suite (ZCS) 9.0, 10.0, and 10.1 stems from insufficient sanitization of HTML content in ICS files. When a victim opens an email with a malicious ICS entry, embedded JavaScript runs in their session via an ontoggle event in a <details> tag, letting an attacker perform unauthorized actions such as setting mail filters to redirect messages and exfiltrate data. The vulnerability is listed in CISA's Known Exploited Vulnerabilities catalog with active exploitation, and a public exploit or detection template exists. Apply the vendor fixes in ZCS 10.0.13 and 10.1.5, or follow vendor mitigations and BOD 22-01 guidance if patching is not immediately possible.
ثغرة تخزين XSS في عميل الويب الكلاسيكي في Synacor Zimbra Collaboration Suite (ZCS) 9.0 و10.0 و10.1 ناتجة عن عدم كفاية تعقيم محتوى HTML في ملفات ICS. عند فتح المستخدم رسالة بريد تحتوي على مدخل ICS خبيث، يُنفَّذ JavaScript المضمّن داخل جلسته عبر حدث ontoggle في وسم <details>، ما يتيح للمهاجم تنفيذ إجراءات غير مصرّح بها مثل ضبط مرشحات البريد لإعادة توجيه الرسائل وتسريب البيانات. الثغرة مدرجة في كتالوج CISA للثغرات المعروفة الاستغلال مع استغلال نشط، ويتوفر استغلال عام أو قالب كشف. طبّق إصلاحات المورّد في ZCS 10.0.13 و10.1.5، أو اتبع إرشادات التخفيف من المورّد وتوجيهات BOD 22-01 إذا تعذّر الترقيع فورًا.
Affected products
- Zimbra Collaboration: from 10.0.0 before 10.0.13; from 10.1.0 before 10.1.5; 9.0.0, 9.0.0-p1, 9.0.0-p10, 9.0.0-p11, 9.0.0-p12, 9.0.0-p13 (+39) — fixed in 10.0.13, 10.1.5
How to fix
Upgrade to a fixed version: Zimbra Collaboration 10.0.13, 10.1.5. Check the vendor advisory for mitigations.
References
- https://wiki.zimbra.com/wiki/Security_Center
- https://wiki.zimbra.com/wiki/Zimbra_Releases/10.0.13#Security_Fixes
- https://wiki.zimbra.com/wiki/Zimbra_Releases/10.1.5#Security_Fixes
- https://wiki.zimbra.com/wiki/Zimbra_Releases/9.0.0/P44#Security_Fixes
- https://strikeready.com/blog/0day-ics-attack-in-the-wild/
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-27915
Get alerted when CVE-2025-27915 or the next vulnerability affects your stack