An issue was discovered in Zimbra Collaboration (ZCS) 10.0 and 10.1.

published 2026-03-20 7 mo ago modified 2026-06-17 4 mo ago also EUVD-2026-13694

cvss: 6.1; version 3.1, CNA
cisa kev: Not listed; not in CISA's catalog
epss: 0.2%; EPSS 0.2% chance of exploitation in 30 days, percentile 11%
public exploits: 0; none known

An issue was discovered in Zimbra Collaboration (ZCS) 10.0 and 10.1. A stored cross-site scripting (XSS) vulnerability exists in the Zimbra Briefcase feature due to insufficient sanitization of specific uploaded file types. When a user opens a publicly shared Briefcase file containing malicious scripts, the embedded JavaScript executes in the context of the user's session. This allows an attacker to run arbitrary scripts, potentially leading to data exfiltration or other unauthorized actions on behalf of the victim user.

Patch / fix

fixed in 1

synacor zimbra_collaboration_suite 10.1.16

CISA SSVC

Exploitation: none
Automatable: no
Technical impact: partial
Assessed: 7 mo ago (2026-03-23)

Exploit prediction

0.21% chance of exploitation in the next 30 days, higher than 11% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by	version	score	vector
CISA ADP	3.1	6.1	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
CNA	3.1	6.1	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Classification

Weakness

CWE-79 Improper Neutralization of Input During Web Page Generation

References

wiki.zimbra.com /wiki/Zimbra_Security_Advisories
vendor-advisory
wiki.zimbra.com /wiki/Security_Center
release-notes, vendor-advisory
wiki.zimbra.com /wiki/Zimbra_Responsible_Disclosure_Policy
product
wiki.zimbra.com /wiki/Zimbra_Releases/10.1.16#Security_Fixes
release-notes

Sources

CVE List CVE-2026-33370
NVD CVE-2026-33370

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary