All vulnerabilities
CVE-2026-93643

Zimbra Collaboration Suite OnlyOffice Integration Path Traversal Leading to Remote Code Execution via Unauthenticated /downloadas Request

Zimbra Zimbra Collaboration Suite (ZCS)Applications & CMS
Open in ThreatlineRecord JSON
CVSS
9.8Critical
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.96%Chance of exploitation activity in the next 30 days, higher than 61% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in10.1.21Fixed versionCVE List
Published25 Sep 2026Updated 26 Sep 2026CVE List

What fixes it

  • 10.1.21Zimbra Collaboration Suite (ZCS)CVE List

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

When OnlyOffice/Document Editing is available, an unauthenticated remote attacker with access to an existing supported public Briefcase document can abuse unsigned save fields to perform path-traversal writes and execute commands as zimbra.

Text from CVE List

Affected versions 1

  • Zimbra Collaboration Suite (ZCS)affected: all versions before 10.1.21CVE List

References 1