Vulnerability

CERT-In Vulnerability Note CIVN-2025-0242
Cross-Site Scripting Vulnerability in Zimbra Collaboration Suite

Original Issue Date:October 06, 2025

Severity Rating: HIGH

Software Affected

Zimbra Collaboration Kepler version prior to 9.0.0 P44
Zimbra Collaboration Daffodil version prior to 10.0.13
Zimbra Collaboration Daffodil version prior to 10.1.5

Overview

A vulnerability has been reported in Zimbra Collaboration Suite which could allow a remote attacker to perform cross-site scripting (XSS) attack on the targeted system.

Target Audience:
Organizations and individuals using the affected Zimbra Collaboration versions.

Risk Assessment:
High risk of sensitive data disclosure and account compromise.

Impact Assessment:
Potential for complete account take-over and data exfiltration.

Description

Zimbra Collaboration Suite (ZCS) is an open-source communication and collaboration platform offering functionalities such as email, calendar, contact, and document management in both on-premises and cloud deployments.

This vulnerability exists in the Zimbra Classic Web Client due to insufficient sanitization of HTML content in ICS (iCalendar) files. An attacker can inject malicious JavaScript that executes within a victims session, potentially enabling actions such as modifying mail filters to redirect messages to an attacker-controlled email account.

Successful exploitation of this vulnerability could allow an attacker to perform unauthorized activities on the victims account, including e-mail redirection and data exfiltration.

Note: This vulnerability (CVE‑2025‑27915) is being exploited in the wild. Users are advised to apply patches urgently.

Solution

Apply appropriate software updates as mentioned by the vendor:
https://wiki.zimbra.com/wiki/Zimbra_Releases/9.0.0/P44#Security_Fixes

https://wiki.zimbra.com/wiki/Zimbra_Releases/10.0.13#Security_Fixes

https://wiki.zimbra.com/wiki/Zimbra_Releases/10.1.5#Security_Fixes

Vendor Information

Zimbra
https://wiki.zimbra.com/wiki/Zimbra_Releases/9.0.0/P44#Security_Fixes
https://wiki.zimbra.com/wiki/Zimbra_Releases/10.0.13#Security_Fixes
https://wiki.zimbra.com/wiki/Zimbra_Releases/10.1.5#Security_Fixes

References

CVE Name
CVE-2025-27915

Disclaimer

The information provided herein is on "as is" basis, without warranty of any kind.

Contact Information

Email: info@cert-in.org.in
Phone: +91-11-22902657

Postal address

Indian Computer Emergency Response Team (CERT-In)
Ministry of Electronics and Information Technology
Government of India
Electronics Niketan
6, CGO Complex, Lodhi Road,
New Delhi - 110 003
India