{"id":"CVE-2022-41352","kind":"vulnerability","aliases":["CVE-2022-41352"],"related":[],"title":"synacor zimbra collaboration suite: An issue was discovered in Zimbra Collaboration (ZCS) 8.8.15 and 9.0","description":"An issue was discovered in Zimbra Collaboration (ZCS) 8.8.15 and 9.0. An attacker can upload arbitrary files through amavis via a cpio loophole (extraction to /opt/zimbra/jetty/webapps/zimbra/public) that can lead to incorrect access to any other user accounts. Zimbra recommends pax over cpio. Also, pax is in the prerequisites of Zimbra on Ubuntu; however, pax is no longer part of a default Red Hat installation after RHEL 6 (or CentOS 6). Once pax is installed, amavis automatically prefers it over cpio.","summary":"Zimbra Collaboration Suite has an arbitrary file upload flaw in its cpio package handling. An attacker can upload files and gain access to other users' accounts.","severity":"critical","cvss":9.8,"epss":null,"exploited":true,"exploited_at":"2022-10-20T00:00:00+00:00","products":[{"name":"Synacor Zimbra Collaboration Suite (ZCS)","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"synacor zimbra collaboration suite","fixed":[],"affected":"= 9.0.0","ecosystem":"vendor"},{"name":"synacor zimbra collaboration suite","fixed":[],"affected":"= 8.8.15","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["email","exploited","ransomware","runtime","self-hosted","zimbra"],"not_affected_if":["managed-hosting"],"how_to_check":null,"fix":"Apply the vendor's updates per Zimbra instructions; CISA's required action is to apply updates per vendor instructions. Specific fixed versions are unknown from the sources.","status":"open","published_at":"2022-09-26T02:15:10+00:00","first_seen_at":"2026-10-23T19:11:52+00:00","triaged_at":"2026-10-23T21:10:31+00:00","updated_at":"2026-10-23T22:29:04+00:00","category":"runtime","confidence":0.6,"triage":{"at":"2026-10-23T21:10:31Z","model":"claude-haiku-5-5","output":{"fix":"Apply the vendor's updates per Zimbra instructions; CISA's required action is to apply updates per vendor instructions. Specific fixed versions are unknown from the sources.","reach":"unknown","impact":"high","summary":"Zimbra Collaboration Suite has an arbitrary file upload flaw in its cpio package handling. An attacker can upload files and gain access to other users' accounts.","category":"runtime","who_cares":["zimbra","self-hosted","email"],"confidence":0.6,"needs_auth":"unknown","worst_case":"Attacker uploads arbitrary files and takes over other user accounts.","analyst_note":"Find the fixed Zimbra versions and the vendor advisory for CVE-2022-41352, plus a way to check for exploitation indicators, since the sources give no version or check details.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["managed-hosting"],"user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000464,"input_tokens":2848,"output_tokens":358,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2022':17A,20A '-41352':18A,21A '/opt/zimbra/jetty/webapps/zimbra/public':94C '6':135C,138C '8.8.15':13A,77C '9.0':15A,79C 'access':64B,100C 'account':68B,105C 'also':111C 'amavi':87C,143C 'arbitrari':48B,84C 'attack':58B,81C 'automat':144C 'cento':137C 'collabor':3A,11A,44B,75C 'collaboration':24A,29A,33A 'cpio':54B,90C,110C,148C 'cve':16A,19A 'default':129C 'discov':8A,72C 'email':35B 'exploit':36B 'extract':92C 'file':49B,61B,85C 'flaw':51B 'gain':63B 'handl':56B 'hat':131C 'host':41B 'howev':121C 'incorrect':99C 'instal':132C,142C 'issu':6A,70C 'lead':97C 'longer':125C 'loophol':91C 'packag':55B 'part':126C 'pax':108C,112C,122C,140C 'prefer':145C 'prerequisit':116C 'ransomwar':37B 'recommend':107C 'red':130C 'rhel':134C 'runtim':38B 'self':40B 'self-host':39B 'suit':4A,45B 'suite':25A,30A,34A 'synacor':1A,22A,27A,31A 'ubuntu':120C 'upload':50B,60B,83C 'user':67B,104C 'via':88C 'zcs':12A,26A,76C 'zimbra':2A,10A,23A,28A,32A,42B,43B,74C,106C,118C","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2022-09-26T02:15:10+00:00","kev":{"dateAdded":"2022-10-20","dueDate":"2022-11-10","requiredAction":"Apply updates per vendor instructions.","knownRansomwareCampaignUse":"Known"},"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cvss_by":"nvd@nist.gov","poc_count":0,"sources":[{"source":"kev","external_id":"CVE-2022-41352","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2022-41352","severity":null,"published_at":"2022-10-20T00:00:00+00:00","modified_at":null,"first_seen_at":"2026-10-23T19:11:52+00:00","fetched_at":"2026-10-25T10:39:06+00:00","note":null},{"source":"nvd","external_id":"CVE-2022-41352","url":"https://nvd.nist.gov/vuln/detail/CVE-2022-41352","severity":null,"published_at":"2022-09-26T02:15:10+00:00","modified_at":"2026-09-10T04:17:37+00:00","first_seen_at":"2026-10-23T22:29:04+00:00","fetched_at":"2026-10-23T22:29:04+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}