Arbitrary File Upload and Directory Traversal in Zimbra Collaboration (ZCS) 8.8.15 and 9.0

CVE-2022-27925 · HIGH Severity

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Zimbra Collaboration (aka ZCS) 8.8.15 and 9.0 has mboximport functionality that receives a ZIP archive and extracts files from it. An authenticated user with administrator rights has the ability to upload arbitrary files to the system, leading to directory traversal.

Learn more about our User Device Pen Test.