Zimbra Collaboration patches two stored XSS bugs
CERT Polska discloses two stored XSS vulnerabilities in Zimbra Collaboration pre-10.1.21, exploitable via crafted email headers to hijack victim sessions.
Sourcecert.pl — open the original
What to check
- Applies to
- The 2 CVEs named below. Whether you run an affected version is not assessed: check the versions the source lists.
- Exploitation
- No exploitation in the wild and no public exploit is recorded for the CVEs named.
CERT Polska, together with independent researcher Suraj Disoja of TrustFoundry, disclosed two stored cross-site scripting vulnerabilities in Synacor's Zimbra Collaboration software affecting all versions prior to 10.1.21. Both issues stem from insufficient sanitization of email header content rendered in the Zimbra web interface.
CVE-2026-66911 involves the Content-Location MIME header in email attachments: an unauthenticated attacker can set this header to a javascript: URI, and when a victim opens the email in Zimbra's web interface and clicks the attachment name, the payload executes in the victim's browser context. CVE-2026-66912 affects the From header during HTML reply composition in Classic UI — a crafted From header with an embedded JavaScript payload executes when a victim opens the message, enables HTML mode with reply headers disabled, and clicks Reply. Both flaws allow an attacker to steal session information or perform actions on behalf of the victim.
No evidence of in-the-wild exploitation is mentioned in the advisory. Both vulnerabilities were fixed in Zimbra Collaboration 10.1.21. Defenders running Zimbra should upgrade to 10.1.21 or later; detection should focus on inbound emails with unusual Content-Location or From header values containing javascript: URIs or embedded script tags.
Mentioned in this report
Source reporting: https://cert.pl/en/posts/2026/10/CVE-2026-66911
Free public brief. Slack alerts on the vendors you run come with the paid plans, and a new account gets three days of them, no card.
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries live profiles of the CVEs it names. The paid plans add the security research and news reporting the free tier leaves out.
It sits in a corpus of 16,445 reports from 149 sources, 666 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Slack alerts are a paid-plan feature: name the vendors you run and Slack hears about the reports that touch them, not the rest of the week's. Nothing is charged unless you subscribe.
Create a free account What it costs