CVE-2022-27925

Zimbra Collaboration (aka ZCS) 8.8.15 and 9.0 has mboximport functionality that receives a ZIP archive and extracts files from it. An authenticated user with administrator rights has the ability to upload arbitrary files to the system, leading to directory traversal.

CVSS 3.1

7.2CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

EPSS

99% chance of exploitation in the next 30 days; higher than 99% of CVEs (scores of 2026-10-25)

CISA KEV

listed 2022-08-11, due 2022-09-01, known ransomware use

CWE

CWE-22

Published

2022-04-21

Modified

2026-10-01

Record from

the NVD, synced 2026-10-19

Affected

• synacor:zimbra_collaboration_suite

References

• http://packetstormsecurity.com/files/168146/Zimbra-Zip-Path-Traversal.html
• https://wiki.zimbra.com/wiki/Security_Center
• https://wiki.zimbra.com/wiki/Zimbra_Releases/9.0.0/P24
• https://wiki.zimbra.com/wiki/Zimbra_Security_Advisories
• http://packetstormsecurity.com/files/168146/Zimbra-Zip-Path-Traversal.html

Check your stackJSON