UpHeron
All vulnerabilities

Servers and applications

CVE-2026-93633

A CSS sanitization vulnerability in Zimbra Collaboration Suite (ZCS) allows an authenticated user with Briefcase access to publish a document that displays attacker-controlled content under the Zimbra origin. When processing a stylesheet containing non-ASCII characters, DefangFilter appends the final ASCII segment without sanitizing it. HTML stored as application/x-zimbra-doc can therefore…

Severity
Medium 5.4
Published
23 Oct 2026
Last changed
28 Oct 2026
Added to UpHeron
1 Nov 2026
Sources
NVD

Affected software

SoftwareAffected versions
Zimbra CollaborationServers and applications · cpe:a:synacor:zimbra_collaboration_suite
  • Every version up to 10.1.20

References

  • NVD https://nvd.nist.gov/vuln/detail/CVE-2026-93633
  • CVE.org https://www.cve.org/CVERecord?id=CVE-2026-93633