CVE-2025-68645highunder attackCWE-98

CVE-2025-68645

Published · Updated

Follow this CVE+ Monitor Zimbra Collaboration Suite

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

98Vexday Risk Score

Patch now. It under exploitation confirmed by CISA and has a working public exploit.

ssvc Actcvss 8.8epss 51%
from disclosure to weapon8 days
Published on NVDDec 22
1st PoC+8d
CISA KEV+31d
Action required by CISAfederal deadline: 2026-02-12

Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

In short

A flaw in Zimbra Webmail allows attackers to read files from the server by crafting special requests, without needing to log in. This exposes sensitive information stored on the web server.

Technical detail

Local File Inclusion vulnerability in RestFilter servlet of Zimbra ZCS 10.0/10.1 caused by improper parameter validation in /h/rest endpoint. Unauthenticated remote attacker can manipulate request dispatching to include arbitrary files from WebRoot directory, leading to information disclosure.

Summary generated and translated by AI from the official description.

The full analysis of this CVE is available in Portuguese →

A Local File Inclusion (LFI) vulnerability exists in the Webmail Classic UI of Zimbra Collaboration (ZCS) 10.0 and 10.1 because of improper handling of user-supplied request parameters in the RestFilter servlet. An unauthenticated remote attacker can craft requests to the /h/rest endpoint to influence internal request dispatching, allowing inclusion of arbitrary files from the WebRoot directory.
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Affected products
n/a · n/a
⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.