Zimbra Collaboration Suite 8.8.15/9.0/10.0/10.1 Classic UI cross site scripting

Summaryinfo

A vulnerability marked as problematic has been reported in Zimbra Collaboration Suite 8.8.15/9.0/10.0/10.1. This affects an unknown part of the component Classic UI. The manipulation leads to cross site scripting. This vulnerability is uniquely identified as CVE-2025-48700. The attack is possible to be carried out remotely. Moreover, an exploit is present.

Detailsinfo

A vulnerability was found in Zimbra Collaboration Suite 8.8.15/9.0/10.0/10.1. It has been rated as problematic. This issue affects an unknown code of the component Classic UI. The manipulation with an unknown input leads to a cross site scripting vulnerability. Using CWE to declare the problem leads to CWE-79. The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users. Impacted is integrity. The summary by CVE is:

An issue was discovered in Zimbra Collaboration (ZCS) 8.8.15 and 9.0 and 10.0 and 10.1. A Cross-Site Scripting (XSS) vulnerability in the Zimbra Classic UI allows attackers to execute arbitrary JavaScript within the user's session, potentially leading to unauthorized access to sensitive information. This issue arises from insufficient sanitization of HTML content, specifically involving crafted tag structures and attribute values that include an @import directive and other script injection vectors. The vulnerability is triggered when a user views a crafted e-mail message in the Classic UI, requiring no additional user interaction.

It is possible to read the advisory at wiki.zimbra.com. The identification of this vulnerability is CVE-2025-48700 since 05/23/2025. The exploitation is known to be easy. The attack may be initiated remotely. It demands that the victim is doing some kind of user interaction. Technical details are unknown but an exploit is available. The attack technique deployed by this issue is T1059.007 according to MITRE ATT&CK.

It is declared as attacked. The CISA Known Exploited Vulnerabilities Catalog lists this issue since 04/20/2026 with a due date of 04/23/2026:

Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

The vulnerability is also documented in the vulnerability database at EUVD (EUVD-2025-18891). Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Productinfo

Type

• Groupware Software

Vendor

• Zimbra

Name

• Collaboration Suite

Version

• 8.8.15
• 9.0
• 10.0
• 10.1

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Discussion