PHP file inclusion in Zimbra Collaboration - CVE-2025-68645
Published: November 6, 2025 / Updated: January 23, 2026
Vulnerability identifier: #VU118168
CSH Severity: Critical
CVSS v4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2025-68645
CWE-ID: CWE-98
Exploitation vector: Remote access
Exploit availability:
The vulnerability is being exploited in the wild
Vulnerability details
The vulnerability allows a remote attacker to include and execute arbitrary PHP files on the server.
The vulnerability exists due to incorrect input validation when including PHP files in the RestFilter. A remote non-authenticated attacker can send a specially crafted HTTP request to the affected application, include and execute arbitrary PHP code on the system with privileges of the web server.
Affected software
Zimbra Collaboration
How to mitigate CVE-2025-68645
Install updates from vendor's website.
Zimbra Collaboration - addressed in versions 10.0.18, 10.1.13