Vulnerabilities in Zimbra Collaboration software

CERT Polska employee discovered vulnerabilities in Synacor Zimbra Collaboration software during his own research and participated in coordination of their disclosure.

The vulnerabilityCVE-2026-66911: Zimbra is vulnerable to stored cross-site scripting (XSS) via theContent-LocationMIME header in email attachments. Due to lack of sanitization of theContent-Locationheader, an attacker can set it to ajavascript:URI. An unauthenticated remote attacker can send a crafted email to a victim; when the victim opens the email in the Zimbra web interface and clicks the attachment name, the JavaScript payload executes in the victim's browser context.

The vulnerabilityCVE-2026-66912: Zimbra is vulnerable to Stored Cross-Site Scripting (XSS) via theFromemail header during HTML reply composition in Classic UI. Due to insufficient sanitization of the From header value, a remote attacker can send a crafted email containing a maliciousFromheader with an embedded JavaScript payload. When the victim opens the message in Classic UI and clicksReplywhile composing in HTML mode with reply headers disabled, the unsanitizedFromheader content is rendered as HTML and the JavaScript payload executes in the victim's browser, potentially allowing the attacker to steal session information or perform actions on behalf of the victim.

These issues were fixed in version 10.1.21

We thank Suraj Disoja (TrustFoundry), who independently discovered CVE-2026-66911 and responsibly reported it to the vendor.