Synacor · Zimbra Collaboration Suite (ZCS)
CVE-2022-41352
Synacor Zimbra Collaboration Suite (ZCS) Arbitrary File Upload Vulnerability
What it is
An issue was discovered in Zimbra Collaboration (ZCS) 8.8.15 and 9.0. An attacker can upload arbitrary files through amavis via a cpio loophole (extraction to /opt/zimbra/jetty/webapps/zimbra/public) that can lead to incorrect access to any other user accounts. Zimbra recommends pax over cpio. Also, pax is in the prerequisites of Zimbra on Ubuntu; however, pax is no longer part of a default Red Hat installation after RHEL 6 (or CentOS 6). Once pax is installed, amavis automatically prefers it over cpio.
CISA: Synacor Zimbra Collaboration Suite (ZCS) allows an attacker to upload arbitrary files using cpio package to gain incorrect access to any other user accounts.
What to do
Apply updates per vendor instructions.
Deadline for US federal agencies: November 10, 2022
- Added to the CISA list
- October 20, 2022
- Published
- September 26, 2022
- Severity
- Critical 9.8 CVSS 3.1
- Chance of attacks in the next 30 days (EPSS)
- 95% in the top 0.1% of all known vulnerabilities
- Weakness
- CWE-22
- More details
- NVD · CVE.org · CISA
All references (5)
- https://wiki.zimbra.com/wiki/Zimbra_Security_Advisories
- https://wiki.zimbra.com/wiki/Security_Center
- https://forums.zimbra.org/viewtopic.php?t=71153&p=306532
- http://packetstormsecurity.com/files/169458/Zimbra-Collaboration-Suite-TAR-Path-Traversal.html
- https://www.secpod.com/blog/unpatched-rce-bug-in-zimbra-collaboration-suite-exploited-in-wild/
More exploited flaws from Synacor
| Added | Vulnerability | Product | Severity | Attack chance |
|---|---|---|---|---|
| Aug 21, 2026 | OS Command Injection | Zimbra Collaboration Suite (ZCS) | High 8.9 | 72% |
| Apr 20, 2026 | Cross-site Scripting | Zimbra Collaboration Suite (ZCS) | Medium 6.1 | 1.7% |
| Mar 18, 2026 | Cross-Site Scripting | Zimbra Collaboration Suite (ZCS) | High 7.2 | 20% |
| Oct 7, 2025 | Cross-site Scripting | Zimbra Collaboration Suite (ZCS) | Medium 5.4 | 4.1% |
| Jul 7, 2025 | Server-Side Request Forgery (SSRF) | Zimbra Collaboration Suite (ZCS) | High 7.5 | 81% |
| May 19, 2025 | Cross-Site Scripting (XSS) | Zimbra Collaboration Suite (ZCS) | Medium 6.1 | 25% |
| Feb 25, 2025 | Cross-Site Scripting (XSS) | Zimbra Collaboration Suite (ZCS) | Critical 9.0 | 77% |
| Oct 3, 2024 | Command Execution | Zimbra Collaboration Suite (ZCS) | Critical 10.0 | 99.9% |
Sources: Known Exploited Vulnerabilities (CISA, public domain), CVE records (cve.org) and EPSS (FIRST). The chance of attacks is the EPSS estimate that someone will try to exploit the flaw in the next 30 days.