Research · Dec 22, 2025
Critical PHP Remote File Inclusion Vulnerability Discovered in Zimbra Collaboration Suite
A serious Local File Inclusion vulnerability has been identified in the Zimbra Collaboration Suite, potentially exposing sensitive data to unauthorized access.
What changed
A Local File Inclusion (LFI) vulnerability has been discovered in the Zimbra Collaboration Suite (ZCS), specifically affecting versions 10.0 and 10.1. This flaw arises from improper handling of user-supplied request parameters within the RestFilter servlet.
- Unauthenticated attackers can exploit this vulnerability.
- The flaw allows for arbitrary file inclusion from the WebRoot directory.
- Attackers can craft specific requests to the /h/rest endpoint.
Who is affected
The vulnerability impacts organizations utilizing the Zimbra Collaboration Suite for their email and collaboration needs. This could lead to unauthorized access to sensitive files and data.
- Synacor, the vendor of Zimbra Collaboration Suite.
- Businesses and institutions using ZCS versions 10.0 and 10.1.
- Users relying on the Webmail Classic UI for their email communications.
- IT departments responsible for maintaining secure email systems.
What to do
Organizations using affected versions of ZCS should take immediate action to mitigate risks associated with this vulnerability. Regular updates and patches are essential for maintaining security.
- Upgrade to the latest version of Zimbra Collaboration Suite.
- Review and restrict access to the /h/rest endpoint.
- Implement monitoring to detect any unusual file access patterns.
- Educate users about the risks associated with unauthorized access.