Read the docs
TI-2026-79913 Aliases CVE-2026-93633GHSA-x7vx-vqqq-6frh

Cross-site scripting in Zimbra Collaboration Suite Briefcase

Priority LOW 24CWE-79Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
Required
Attack complexity
Low
Impact type
Cross-site scripting
Confidentiality · integrity · availability
Low · Low · None
Fix status
No fix listed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-79.

Summary

Zimbra Collaboration Suite (ZCS) versions from 0 through 10.1.20 are affected, including 10.1.16 and 10.1.20. When a stylesheet contains non-ASCII characters, the DefangFilter leaves the final ASCII segment unsanitized, so CSS URL references survive in documents stored as application/x-zimbra-doc (CWE-79). An authenticated user with Briefcase access can share a crafted document that loads external resources and displays a credential-collection form under the Zimbra origin. The victim must open the document in a browser that renders the content type inline, and credential theft also requires form submission; an exploit link is listed in the references.

Written with Claude Haiku 5.5 from the sources below · 2026-10-29

Description from the CNA

A CSS sanitization vulnerability in Zimbra Collaboration Suite (ZCS) allows an authenticated user with Briefcase access to publish a document that displays attacker-controlled content under the Zimbra origin. When processing a stylesheet containing non-ASCII characters, DefangFilter appends the final ASCII segment without sanitizing it. HTML stored as application/x-zimbra-doc can therefore retain CSS URL references that the normal sanitizer removes. An attacker can share a crafted document that loads external resources and displays a credential-collection form using Zimbra's own visual assets. Exploitation requires the victim to open the document in a browser that renders the content type inline; credential theft additionally requires form submission. ZCS 10.1.16 and 10.1.20 are affected.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00234 14th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
ZimbraZimbra Collaboration Suiteup to 10.1.20—No fix listedCNA
  • Zimbra Collaboration Suite VendorZimbra Affected up to 10.1.20 Fixed in — No fix listed CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:synacor:zimbra_collaboration_suite:*:*:*:*:*:*:*:*up to 10.1.20VulnerableSynacor
  • cpe:2.3:a:synacor:zimbra_collaboration_suite:*:*:*:*:*:*:*:* Versions up to 10.1.20 Vulnerable ·Synacor

Remediation

The sources list no fixed version for Zimbra Collaboration Suite.

Written with Claude Haiku 5.5 from the sources below · 2026-10-29

Timeline

  1. 2026-10-23 Threatist record created from CVE-2026-93633
  2. 2026-10-23 Alias added: GHSA-x7vx-vqqq-6frh
  3. 2026-10-24 Priority changed: MEDIUM → LOW
  4. 2026-10-28 CISA SSVC decision points changed

References

Exploit 1

Advisory 1

  • TI-2026-51660 OS command injection in Zimbra Collaboration KEVCVSS 3.1HIGH 8.9
  • TI-2025-40820 Cross-site scripting in Zimbra Collaboration KEVCVSS 3.1HIGH 7.2
  • TI-2024-18266 An issue was discovered in Zimbra Collaboration (ZCS) 9.0 and 10.0. KEVCVSS 3.1MEDIUM 6.1
  • TI-2024-30553 An issue was discovered in Zimbra Collaboration (ZCS) 10.1.x before 10.1.1, 10.0.x before… CVSS 3.1HIGH 8.8
  • TI-2022-13998 Zimbra Collaboration Open Source 8.8.15 does not encrypt the initial-login randomly… CVSS 3.1CRITICAL 9.8
  • TI-2026-63080 Path traversal in Zimbra Collaboration Suite CVSS 3.1CRITICAL 9.8
See all 94 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences