CVE-2026-93633: medium-severity vulnerability in Zimbra Collaboration Suite
Zimbra Collaboration Suite Briefcase CSS Sanitization Bypass via Non-ASCII Stylesheet Characters
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
13Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 5.4epss 0.2%
A CSS sanitization vulnerability in Zimbra Collaboration Suite (ZCS) allows an authenticated user with Briefcase access to publish a document that displays attacker-controlled content under the Zimbra origin. When processing a stylesheet containing non-ASCII characters, DefangFilter appends the final ASCII segment without sanitizing it. HTML stored as application/x-zimbra-doc can therefore retain CSS URL references that the normal sanitizer removes. An attacker can share a crafted document that loads external resources and displays a credential-collection form using Zimbra's own visual assets. Exploitation requires the victim to open the document in a browser that renders the content type inline; credential theft additionally requires form submission. ZCS 10.1.16 and 10.1.20 are affected.
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Affected products
Zimbra · Zimbra Collaboration SuiteRelated CVEs — Zimbra Collaboration Suite
In the same product, most dangerous first.
CVE-2026-115785MEDIUMZimbra Collaboration Suite Data Source Test SMTP Command Injection via Unsanitized Email AddressEPSS 0.7%CVE-2026-93639HIGHZimbra Collaboration Suite Missing Authorization in ConfigureZimlet Enables Delegated Administrator Privilege EscalationEPSS 0.4%CVE-2026-115786MEDIUMZimbra Collaboration Suite Shared-File Mailbox Quota Accounting Error Enables Quota ExhaustionEPSS 0.4%CVE-2026-50055MEDIUMZimbra Collaboration Suite Sieve Notify Filter Action Bypasses Mail Forwarding Restriction via Variable ExpansionEPSS 0.4%CVE-2026-50056HIGHZimbra Collaboration Suite Local Privilege Escalation via zmmailboxdmgr JVM Argument InjectionEPSS 0.3%CVE-2026-93636MEDIUMZimbra Collaboration Suite LDAP Filter Injection via Calendar Resource Attribute NameEPSS 0.3%