CVE-2022-41352

Zimbra Collaboration has a vulnerability that allows attackers to upload malicious files through the email scanning system (amavis), which can then be accessed by other users. This happens because of a flaw in how files are extracted and stored, potentially giving attackers access to other people's accounts.

CVE-2022-41352 exploits a path traversal vulnerability (CWE-22) in amavis integration where cpio extraction to /opt/zimbra/jetty/webapps/zimbra/public allows arbitrary file upload and placement, enabling unauthorized access to other user accounts. Exploitation requires the ability to send crafted email attachments through amavis; remediation involves switching from cpio to pax for archive extraction.