Read the docs
TI-2026-79881 Aliases CVE-2026-10632GHSA-rjjq-j274-2p2c

Reflected cross-site scripting in Zimbra Classic Web Client packages parameter

Priority LOW 39CWE-79Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
Required
Attack complexity
Low
Impact type
Cross-site scripting
Confidentiality · integrity · availability
High · High · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-79.

Summary

Zimbra Collaboration Suite (ZCS) 10.1.16 contains a reflected cross-site scripting flaw in the Classic Web Client, where the packages parameter of the /h/rest document editor is inserted into script attributes without HTML encoding (CWE-79). An attacker with an ordinary Zimbra account can combine this with CVE-2026-50053 to run JavaScript in another signed-in user's browser session when that user opens a crafted URL. The attacker can then read mailbox data and perform authenticated actions as the victim.

Written with Claude Haiku 5.5 from the sources below · 2026-10-28

Description from the CNA

A reflected cross-site scripting vulnerability in the Classic Web Client of Zimbra Collaboration Suite (ZCS) allows an attacker to inject JavaScript through the packages parameter of the /h/rest document editor. The editor inserts package names into script attributes without HTML encoding. When combined with CVE-2026-50053, an attacker with an ordinary Zimbra account can supply their own authentication token and document identifiers in a URL and execute JavaScript in another signed-in user's Zimbra browser session when that user opens the URL. This permits reading mailbox data and performing authenticated actions as the victim. The issue affects ZCS 10.1.16 and was remediated in 10.1.17.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00301 23rd percentileScored 2026-11-07
Fix Fixed Zimbra Collaboration Suite (Zimbra): 10.1.17

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
ZimbraZimbra Collaboration Suitebefore 10.1.1710.1.17Patch availableCNA
  • Zimbra Collaboration Suite VendorZimbra Affected before 10.1.17 Fixed in 10.1.17 Patch available CNA

CPE names Threatist (inferred) · 1

Inferred from how NVD named this product before; not given by a source.

CPEVersionsRoleVendor
cpe:2.3:a:synacor:zimbra_collaboration_suite:*:*:*:*:*:*:*:*——Synacor
  • cpe:2.3:a:synacor:zimbra_collaboration_suite:*:*:*:*:*:*:*:* Versions — — ·Synacor

Remediation

Upgrade Zimbra Collaboration Suite to version 10.1.17, which fixes the issue.

Written with Claude Haiku 5.5 from the sources below · 2026-10-28

  • Fix · CNA Zimbra Collaboration Suite (Zimbra) Fixed in 10.1.17

Timeline

  1. 2026-10-23 Threatist record created from CVE-2026-10632
  2. 2026-10-23 Alias added: GHSA-rjjq-j274-2p2c
  3. 2026-10-24 Priority changed: MEDIUM → LOW
  4. 2026-10-28 CISA SSVC decision points changed

References

Advisory 1

Other 1

  • TI-2026-51660 OS command injection in Zimbra Collaboration KEVCVSS 3.1HIGH 8.9
  • TI-2025-40820 Cross-site scripting in Zimbra Collaboration KEVCVSS 3.1HIGH 7.2
  • TI-2024-18266 An issue was discovered in Zimbra Collaboration (ZCS) 9.0 and 10.0. KEVCVSS 3.1MEDIUM 6.1
  • TI-2024-30553 An issue was discovered in Zimbra Collaboration (ZCS) 10.1.x before 10.1.1, 10.0.x before… CVSS 3.1HIGH 8.8
  • TI-2022-13998 Zimbra Collaboration Open Source 8.8.15 does not encrypt the initial-login randomly… CVSS 3.1CRITICAL 9.8
  • TI-2026-63080 Path traversal in Zimbra Collaboration Suite CVSS 3.1CRITICAL 9.8
See all 94 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences