Stored cross-site scripting in Zimbra Collaboration - #VU118170
Published: November 6, 2025
Vulnerability identifier: #VU118170
CSH Severity: High
CVSS v4: 6.4 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:H/SI:H/SA:N]
CVE-ID: N/A
CWE-ID: CWE-79
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The disclosed vulnerability allows a remote attacker to perform cross-site scripting (XSS) attacks.
The vulnerability exists due to insufficient sanitization of user-supplied data in Zimbra Mail Client for emails with PDF attachments. A remote attacker can send a specially crafted email to the victim and execute arbitrary HTML and script code in user's browser in context of vulnerable website.
Affected software
Zimbra Collaboration
Remediation
Install updates from vendor's website.
Zimbra Collaboration - update to 10.1.13