We use these services and cookies to improve your user experience. You may opt out if you wish, however, this may limit some features on this site.
Please see our statement on Data Privacy.
An issue was discovered in Zimbra Collaboration (ZCS) through 10.1. A Cross-Site Scripting (XSS) vulnerability exists in Zimbra webmail due to insufficient validation of the content type metadata when importing files into the briefcase. Attackers can exploit this issue by crafting a file with manipulated metadata, allowing them to bypass content type checks and execute arbitrary JavaScript within the victim's session.
Reserved 2024-09-01 | Published 2025-07-30 | Updated 2025-07-30 | Assigner mitrewiki.zimbra.com/wiki/Zimbra_Security_Advisories
wiki.zimbra.com/wiki/Security_Center
wiki.zimbra.com/wiki/Zimbra_Responsible_Disclosure_Policy
wiki.zimbra.com/wiki/Zimbra_Releases/10.0.9
Support options
