CVE-2025-48700: Synacor Zimbra Collaboration Suite (ZCS) Cross-site Scripting Vulnerability

Severity: medium (CVSS 6.1 v3.1)
Exploited in the wild: yes — in CISA KEV since 2026-04-20
EPSS: 1.7% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2025-06-23 · updated 2026-06-17
Weakness: CWE-79

Description

An issue was discovered in Zimbra Collaboration (ZCS) 8.8.15 and 9.0 and 10.0 and 10.1. A Cross-Site Scripting (XSS) vulnerability in the Zimbra Classic UI allows attackers to execute arbitrary JavaScript within the user's session, potentially leading to unauthorized access to sensitive information. This issue arises from insufficient sanitization of HTML content, specifically involving crafted tag structures and attribute values that include an @import directive and other script injection vectors. The vulnerability is triggered when a user views a crafted e-mail message in the Classic UI, requiring no additional user interaction.

Summary

CVE-2025-48700 is a cross-site scripting (XSS) flaw in the Zimbra Classic UI caused by insufficient sanitization of HTML content, including crafted tag structures and attribute values with an @import directive. Viewing a crafted email in the Classic UI executes arbitrary JavaScript in the user's session, potentially exposing sensitive information, and requires no additional user interaction. It affects Zimbra Collaboration (ZCS) 8.8.15, 9.0, 10.0 and 10.1, and is listed in CISA's Known Exploited Vulnerabilities catalog with active exploitation. Apply vendor mitigations or upgrade to 10.0.12 or 10.1.4, and follow BOD 22-01 guidance for cloud services.

CVE-2025-48700 ثغرة Cross-Site Scripting (XSS) في واجهة Zimbra Classic UI ناتجة عن تطهير غير كافٍ لمحتوى HTML، بما في ذلك بنى وسوم وقيم سمات مُصمَّمة تتضمن توجيه @import. يؤدي عرض رسالة بريد إلكتروني مُصمَّمة في Classic UI إلى تنفيذ JavaScript عشوائي داخل جلسة المستخدم، ما قد يتيح الوصول غير المصرح به إلى معلومات حساسة، دون الحاجة إلى أي تفاعل إضافي من المستخدم. تؤثر الثغرة في Zimbra Collaboration (ZCS) 8.8.15 و9.0 و10.0 و10.1، وهي مدرجة في كتالوج CISA للثغرات المعروفة باستغلالها مع استغلال نشط. طبّق إجراءات التخفيف من المورّد أو قم بالترقية إلى 10.0.12 أو 10.1.4، واتبع إرشادات BOD 22-01 الخاصة بالخدمات السحابية.

Affected products

Zimbra Collaboration: from 10.0.0 before 10.0.12; from 10.1.0 before 10.1.4; 8.8.15, 8.8.15-p1, 8.8.15-p10, 8.8.15-p11, 8.8.15-p12, 8.8.15-p13 (+86) — fixed in 10.0.12, 10.1.4

How to fix

Upgrade to a fixed version: Zimbra Collaboration 10.0.12, 10.1.4. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2025-48700 or the next vulnerability affects your stack