CVE-2020-12846

8.0 highEPSS 2.6%

High (8.0) in synacor zimbra collaboration suite. EPSS 2.6% chance of exploitation in the next 30 days.

Zimbra before 8.8.15 Patch 10 and 9.x before 9.0.0 Patch 3 allows remote code execution via an avatar file. There is potential abuse of /service/upload servlet in the webmail subsystem. A user can upload executable files (exe,sh,bat,jar) in the Contact section of the mailbox as an avatar image for a contact. A user will receive a "Corrupt File" error, but the file is still uploaded and stored locally in /opt/zimbra/data/tmp/upload/, leaving it open to possible remote execution.

Severity

CVSS 3.1

8.0 high

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

EPSS: 2.6% chance of exploitation in the next 30 days; higher than 85% of CVEs (scores of 2026-10-31)
CWE: CWE-434
Published: 2020-06-03
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

synacor:zimbra_collaboration_suite

References

https://wiki.zimbra.com/wiki/Security_Center
https://wiki.zimbra.com/wiki/Zimbra_Releases/9.0.0/P3
https://wiki.zimbra.com/wiki/Zimbra_Security_Advisories
https://wiki.zimbra.com/wiki/Security_Center
https://wiki.zimbra.com/wiki/Zimbra_Releases/9.0.0/P3

Check your stack JSON