This report was translated by AI; nobody has reviewed the translation yet. Original language: Slovak.

[TLP:CLEAR] Zimbra fixes 2 vulnerabilities

Zimbra fixes 2 vulnerabilities in Zimbra Collaboration in versions 10.0.18 and 10.1.13 [1][2].

Zimbra Collaboration - stored XSS (CVE-2025-66376)
CVSS 7.2 (High)

An unauthenticated remote attacker can carry out a stored XSS attack in the Classic UI via a specially crafted HTML e-mail message [1].

The vulnerability is present in product:

  • Zimbra Collaboration; >=10.0, <10.0.18; >=10.1, <10.1.13

CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N

More information:

  • CVE-2025-66376 at cve.org, NVD
  • CWE-79: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') at cwe.mitre.org

The vulnerability was publicly disclosed 5. 1. 2026.

Zimbra Collaboration - hardcoded credentials (CVE-2025-67809)
CVSS 4.7 (Medium)

An unauthenticated remote attacker can abuse the hardcoded API key of the Flickr extension and impersonate this extension during OAuth authentication. Once the request is approved by the user, the user's data may be disclosed [2].

The vulnerability is present in product:

  • Zimbra Collaboration (ZCS); >=10.0, <10.1.13

CVSS: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N

More information:

The vulnerability was publicly disclosed 15. 12. 2025.

By CESNET, z.s.p.o. Henrieta Paločková on 6. 1. 2026.

CESNET, z.s.p.o. Logo