PT-2025-26606 · Zimbra · Zimbra Collaboration

Published 2025-06-23 · Updated 2026-04-25 · CVE-2025-48700

Positive Technologies (AI Summary)

CVSS v2.0

6.4

Medium

AV:N/AC:L/Au:N/C:P/I:P/A:N

Name of the Vulnerable Software and Affected Versions Zimbra Collaboration (ZCS) version 8.8.15 Zimbra Collaboration (ZCS) version 9.0 Zimbra Collaboration (ZCS) version 10.0 Zimbra Collaboration (ZCS) version 10.1

Description A Cross-Site Scripting (XSS) issue in the Zimbra Classic UI allows attackers to execute arbitrary JavaScript within a user session, which can lead to unauthorized access to sensitive information and the theft of session cookies. This occurs due to insufficient sanitization of HTML content, specifically regarding crafted tag structures and attribute values containing the @import directive and other script injection vectors. The issue is triggered when a user views a specially crafted e-mail message in the Classic UI and requires no additional user interaction. This flaw has been exploited in the wild, with over 10,500 unpatched IP addresses reported.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

XSS

Weakness Enumeration

CWE-79

Related Identifiers

BDU:2025-12729

CVE-2025-48700

Affected Products

Zimbra Collaboration

References · 21

• https://nvd.nist.gov/vuln/detail/CVE-2025-48700 · Security Note
• https://bdu.fstec.ru/vul/2025-12729 · Security Note
• https://osv.dev/vulnerability/CVE-2025-48700 · Vendor Advisory
• https://wiki.zimbra.com/wiki/Zimbra_Responsible_Disclosure_Policy · Note
• https://twitter.com/VulmonFeeds/status/1937189128489062468 · Twitter Post
• https://cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-48700 · Note
• https://cisa.gov/known-exploited-vulnerabilities-catalog · Note
• https://wiki.zimbra.com/wiki/Security_Center · Note
• https://t.me/cvetracker/26840 · Telegram Post
• https://twitter.com/CVEnew/status/1937162688259383660 · Twitter Post
• https://twitter.com/ScyScan/status/2046395022569083153 · Twitter Post
• https://twitter.com/Shadowserver/status/2047611944945783280 · Twitter Post
• https://cisa.gov/sites/default/files/csv/known_exploited_vulnerabilities.csv · Note
• https://twitter.com/battista212/status/2046349189886427504 · Twitter Post
• https://wiki.zimbra.com/wiki/Zimbra_Security_Advisories · Security Note, Vendor Advisory