Zimbra Collaboration (aka ZCS) 8.8.15 and 9.0 has mboximport functionality that receives a ZIP archive and extracts files from it. An authenticated user with administrator rights has the ability to upload arbitrary files to the system, leading to directory traversal.
Actively exploited: CISA added it to its Known Exploited Vulnerabilities catalog on 11 Aug 2022.
Severity
High 7.2
Published
21 Apr 2022
Last changed
1 Oct 2026
Added to UpHeron
1 Nov 2026
Sources
NVD
Affected software
Software
Affected versions
Zimbra CollaborationServers and applications · cpe:a:synacor:zimbra_collaboration_suite
Version 9.0.0-p23
Version 9.0.0-p22
Version 9.0.0-p21
Version 9.0.0-p20
All 55 release lines
Version 8.8.15
Version 8.8.15-p1
Version 8.8.15-p2
Version 8.8.15-p3
Version 8.8.15-p4
Version 8.8.15-p5
Version 8.8.15-p6
Version 8.8.15-p7
Version 8.8.15-p8
Version 8.8.15-p9
Version 8.8.15-p10
Version 8.8.15-p11
Version 8.8.15-p12
Version 8.8.15-p13
Version 8.8.15-p14
Version 8.8.15-p15
Version 8.8.15-p16
Version 8.8.15-p17
Version 8.8.15-p18
Version 8.8.15-p19
Version 8.8.15-p20
Version 8.8.15-p21
Version 8.8.15-p22
Version 8.8.15-p23
Version 8.8.15-p24
Version 8.8.15-p25
Version 8.8.15-p26
Version 8.8.15-p27
Version 8.8.15-p28
Version 8.8.15-p29
Version 8.8.15-p30
Version 9.0.0
Version 9.0.0-p1
Version 9.0.0-p2
Version 9.0.0-p3
Version 9.0.0-p4
Version 9.0.0-p5
Version 9.0.0-p6
Version 9.0.0-p7
Version 9.0.0-p8
Version 9.0.0-p9
Version 9.0.0-p10
Version 9.0.0-p11
Version 9.0.0-p12
Version 9.0.0-p13
Version 9.0.0-p14
Version 9.0.0-p15
Version 9.0.0-p16
Version 9.0.0-p17
Version 9.0.0-p18
Version 9.0.0-p19
Version 9.0.0-p20
Version 9.0.0-p21
Version 9.0.0-p22
Version 9.0.0-p23
Known exploited
CISA name
Synacor Zimbra Collaboration Suite (ZCS) Arbitrary File Upload Vulnerability