CVE-2026-66911 in Zimbra Collaboration
Summary
by MITRE • 10/29/2026
Zimbra is vulnerable to stored cross-site scripting (XSS) via the Content-Location MIME header in email attachments. Due to lack of sanitization of the Content-Location header, an attacker can set it to a javascript: URI. An unauthenticated remote attacker can send a crafted email to a victim; when the victim opens the email in the Zimbra web interface and clicks the attachment name, the JavaScript payload executes in the victim's browser context. This issue was fixed in version 10.1.21
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 10/29/2026
The vulnerability identified as stored cross-site scripting within the Zimbra collaboration suite stems from a failure to properly sanitize user-supplied input during the processing of MIME headers, specifically targeting the Content-Location field associated with email attachments. This flaw allows an unauthenticated remote attacker to inject malicious JavaScript code into emails that are subsequently stored on the server's mail store. The root cause lies in the application logic which fails to validate or escape special characters within the Content-Location header before rendering it in the web interface, thereby violating fundamental input validation principles outlined in CWE-79, commonly known as Improper Neutralization of Input During Web Page Generation.
The operational impact of this vulnerability is significant because it enables a stored attack vector rather than a reflected one. An attacker does not need to trick a user into clicking a malicious link; instead, they simply send an email with a crafted attachment header containing a javascript: URI scheme. When the victim logs into their Zimbra account and views the message in the web client, the browser interprets the unsanitized Content-Location value as executable code upon interaction with the attachment element. This results in arbitrary JavaScript execution within the context of the user's session, effectively bypassing same-origin policy protections that would normally isolate different domains or protocols.
From a threat intelligence perspective, this vulnerability aligns with MITRE ATT&CK technique T1059, specifically sub-technique 007 for Command and Scripting Interpreter: JavaScript. The exploitation chain typically involves the attacker crafting an email payload where the Content-Location header is set to javascript:<malicious_script>. Upon rendering in the Zimbra web interface, particularly when a user interacts with the attachment name or preview pane, the browser executes the script. This can lead to severe consequences including session hijacking, credential theft via keylogging scripts, phishing for sensitive corporate data by manipulating the DOM of the mail client, and potentially lateral movement within an organization if the compromised account has access to other internal resources.
The persistence of this vulnerability in earlier versions highlights a critical gap in secure coding practices regarding MIME header handling. Attackers can leverage stored XSS to maintain long-term access or repeatedly exfiltrate data without needing further interaction from the victim beyond opening and viewing emails, which is standard behavior for most users. The lack of output encoding ensures that any special characters such as angle brackets, quotes, or semicolons are passed directly to the browser's parser, allowing complex payloads including DOM-based attacks or cross-site request forgery triggers embedded within the script payload.
Mitigation strategies primarily involve upgrading to Zimbra version 10.1.21 or later where this issue has been resolved through improved input validation and output encoding mechanisms. For organizations unable to immediately patch their infrastructure, temporary mitigations may include implementing web application firewall rules that detect and block javascript: URI schemes within HTTP headers associated with email content types. Additionally, enforcing strict Content Security Policy directives can help mitigate the impact by restricting script execution sources, although this must be carefully configured to avoid breaking legitimate functionality of the Zimbra suite. Regular security audits focusing on MIME parsing logic are recommended to prevent similar vulnerabilities in other components that handle user-controlled data from external sources.