CVE-2026-73573

Severity: medium (CVSS 6.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.5% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-08-13 · updated 2026-08-28
Weakness: CWE-24

Description

In Zimbra Collaboration (ZCS) before 10.1.17, a path traversal vulnerability exists in the Zimbra Briefcase document editing functionality due to improper validation of the packages parameter. An authenticated attacker can exploit this vulnerability by supplying a crafted path traversal sequence, potentially allowing unauthorized disclosure of sensitive files within the web application directory.

Affected products

Zimbra Collaboration: before 10.1.17 — fixed in 10.1.17

How to fix

Upgrade to a fixed version: Zimbra Collaboration 10.1.17. Check the vendor advisory for mitigations.

References

https://wiki.zimbra.com/wiki/Zimbra_Responsible_Disclosure_Policy
https://wiki.zimbra.com/wiki/Zimbra_Security_Advisories

Get alerted when CVE-2026-73573 or the next vulnerability affects your stack