Synacor · Zimbra Collaboration Suite (ZCS)
CVE-2025-68645
Synacor Zimbra Collaboration Suite (ZCS) PHP Remote File Inclusion Vulnerability
O que é
A Local File Inclusion (LFI) vulnerability exists in the Webmail Classic UI of Zimbra Collaboration (ZCS) 10.0 and 10.1 because of improper handling of user-supplied request parameters in the RestFilter servlet. An unauthenticated remote attacker can craft requests to the /h/rest endpoint to influence internal request dispatching, allowing inclusion of arbitrary files from the WebRoot directory.
CISA: Synacor Zimbra Collaboration Suite (ZCS) contains a PHP remote file inclusion vulnerability that could allow for remote attackers to craft requests to the /h/rest endpoint to influence internal request dispatching, allowing inclusion of arbitrary files from the WebRoot directory.
O que fazer
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Prazo para as agências federais dos EUA: 12 de fevereiro de 2026
Mais falhas exploradas de Synacor
| Adicionado | Vulnerabilidade | Produto | Gravidade | Chance de ataque |
|---|---|---|---|---|
| 21 de ago. de 2026 | OS Command Injection | Zimbra Collaboration Suite (ZCS) | Alto 8,9 | 72% |
| 20 de abr. de 2026 | Cross-site Scripting | Zimbra Collaboration Suite (ZCS) | Média 6,1 | 1,7% |
| 18 de mar. de 2026 | Cross-Site Scripting | Zimbra Collaboration Suite (ZCS) | Alto 7,2 | 20% |
| 17 de fev. de 2026 | (ZCS) Server-Side Request Forgery | Zimbra Collaboration Suite | Crítica 9,8 | 94% |
| 7 de out. de 2025 | Cross-site Scripting | Zimbra Collaboration Suite (ZCS) | Média 5,4 | 4,1% |
| 7 de jul. de 2025 | Server-Side Request Forgery (SSRF) | Zimbra Collaboration Suite (ZCS) | Alto 7,5 | 81% |
| 19 de mai. de 2025 | Cross-Site Scripting (XSS) | Zimbra Collaboration Suite (ZCS) | Média 6,1 | 25% |
| 25 de fev. de 2025 | Cross-Site Scripting (XSS) | Zimbra Collaboration Suite (ZCS) | Crítica 9,0 | 77% |
Fontes: Known Exploited Vulnerabilities (CISA, domínio público), CVE records (cve.org) e EPSS (FIRST). A chance de ataque é a estimativa EPSS de que alguém tente explorar a falha nos próximos 30 dias.