Live › vulnerability › CVE-2022-27925
Go to dashboardZCS 8.8.15 and 9.0 mboximport (/service/extension/backup/mboximport) extracts uploaded ZIPs with directory traversal, so an administrator can write arbitrary files (webshells) and get code execution (NVD CVSS 7.2). On its own it needs admin rights. CVE-2022-37042, an auth bypass on the same endpoint, removes that requirement: the pair is unauthenticated RCE, mass-exploited since about June 2022 (Volexity) and used in ransomware. CISA KEV added 2022-08-11.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 19:11 UTC, 3h before NVD. All times on this page are UTC.
Apply updates per vendor instructions.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| Synacor Zimbra Collaboration Suite (ZCS) | vendor | – | – |
| Zimbra Collaboration Suite (ZCS) | vendor | 8.8.15 < P33; 9.0.0 < P26 (admin-only flaw: < P31 / < P24) | 8.8.15 P33, 9.0.0 P26 |
| synacor zimbra collaboration suite | vendor | = 8.8.15 | – |
| synacor zimbra collaboration suite | vendor | = 9.0.0 | – |
8.8.15 P33 or 9.0.0 P26 (below P31/P24 is exposed to the admin-only flaw; below P33/P26 to the unauthenticated chain)8.8.15 Patch 33 or 9.0.0 Patch 26 (2022-07-28) or later; these fix both CVE-2022-27925 (first fixed in P31/P24) and CVE-2022-37042Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Synacor Zimbra Collaboration Suite (ZCS) contains flaw in the mboximport functionality, allowing an authenticated attacker to upload arbitrary files to perform remote code execution. This vulnerability was chained with CVE-2022-37042 which allows for unauthenticated remote code execution.
CISA required action: Apply updates per vendor instructions.
This page as .md · .json · in your agent: get_signal("CVE-2022-27925")
CISA KEV catalog, Creative Commons 0 · EPSS scores by FIRST, used with attribution · NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.