Read the docs
TI-2026-79911 Aliases CVE-2026-93630GHSA-34q7-82vg-cv73

Hostname canonicalization bypass in Zimbra email HTML sanitizer

Priority LOW 20CWE-180Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Required
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
None · Low · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA.

Summary

Zimbra Collaboration Suite before 10.1.21 has a flaw in its email HTML sanitizers. They check form-action hostnames before browser URL canonicalization (CWE-180), so a percent-encoded hostname can pass the restriction on forms targeting the Zimbra host. An unauthenticated remote attacker can send a crafted email that makes the recipient's browser submit authenticated form requests to Zimbra after the recipient opens it in Classic and submits the form. The flaw does not bypass CSRF-token checks, so an attack also needs an endpoint that accepts the request without them.

Written with Claude Haiku 5.5 from the sources below · 2026-10-28

Description from the CNA

A hostname canonicalization vulnerability in the email HTML sanitizers of Zimbra Collaboration Suite (ZCS) allows an unauthenticated sender to bypass the restriction on forms that target the Zimbra host. DefangFilter and the OWASP ActionAttributePolicy compare the form-action hostname with the request hostname before browser URL canonicalization. A percent-encoded hostname can therefore survive sanitization while the browser submits the form to the normal Zimbra origin with the recipient's authentication cookie. This permits authenticated form requests from a crafted email after the recipient opens it in Classic and submits the form. The issue is present in ZCS 10.1.16 and 10.1.21. It does not bypass an endpoint's CSRF-token checks; a state-changing attack additionally requires an endpoint that accepts the resulting request without that protection.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00288 21st percentileScored 2026-11-07
Fix Fixed Zimbra Collaboration Suite (Zimbra): 10.1.21

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
ZimbraZimbra Collaboration Suitebefore 10.1.2110.1.21Patch availableCNA
  • Zimbra Collaboration Suite VendorZimbra Affected before 10.1.21 Fixed in 10.1.21 Patch available CNA

CPE names Threatist (inferred) · 1

Inferred from how NVD named this product before; not given by a source.

CPEVersionsRoleVendor
cpe:2.3:a:synacor:zimbra_collaboration_suite:*:*:*:*:*:*:*:*——Synacor
  • cpe:2.3:a:synacor:zimbra_collaboration_suite:*:*:*:*:*:*:*:* Versions — — ·Synacor

Remediation

Upgrade Zimbra Collaboration Suite to 10.1.21 or later.

Written with Claude Haiku 5.5 from the sources below · 2026-10-28

  • Fix · CNA Zimbra Collaboration Suite (Zimbra) Fixed in 10.1.21

Timeline

  1. 2026-10-23 Threatist record created from CVE-2026-93630
  2. 2026-10-23 Alias added: GHSA-34q7-82vg-cv73
  3. 2026-10-28 CISA SSVC decision points changed

References

Advisory 1

Other 1

  • TI-2026-51660 OS command injection in Zimbra Collaboration KEVCVSS 3.1HIGH 8.9
  • TI-2025-40820 Cross-site scripting in Zimbra Collaboration KEVCVSS 3.1HIGH 7.2
  • TI-2024-18266 An issue was discovered in Zimbra Collaboration (ZCS) 9.0 and 10.0. KEVCVSS 3.1MEDIUM 6.1
  • TI-2024-30553 An issue was discovered in Zimbra Collaboration (ZCS) 10.1.x before 10.1.1, 10.0.x before… CVSS 3.1HIGH 8.8
  • TI-2022-13998 Zimbra Collaboration Open Source 8.8.15 does not encrypt the initial-login randomly… CVSS 3.1CRITICAL 9.8
  • TI-2026-63080 Path traversal in Zimbra Collaboration Suite CVSS 3.1CRITICAL 9.8
See all 94 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences