---
id: "CVE-2022-41352"
kind: "vulnerability"
aliases: ["CVE-2022-41352"]
title: "synacor zimbra collaboration suite: An issue was discovered in Zimbra Collaboration (ZCS) 8.8.15 and 9.0"
severity: "critical"
cvss: 9.8
epss: null
exploited: true
status: "open"
category: "runtime"
products: [{"name": "Synacor Zimbra Collaboration Suite (ZCS)", "fixed": [], "affected": "", "ecosystem": "vendor"}, {"name": "synacor zimbra collaboration suite", "fixed": [], "affected": "= 9.0.0", "ecosystem": "vendor"}, {"name": "synacor zimbra collaboration suite", "fixed": [], "affected": "= 8.8.15", "ecosystem": "vendor"}]
ecosystems: ["vendor"]
tags: ["email", "exploited", "ransomware", "runtime", "self-hosted", "zimbra"]
not_affected_if: ["managed-hosting"]
published_at: "2022-09-26T02:15:10+00:00"
first_seen_at: "2026-10-23T19:11:52+00:00"
updated_at: "2026-10-23T22:29:04+00:00"
sources: [{"source": "kev", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2022-41352", "first_seen_at": "2026-10-23T19:11:52+00:00"}, {"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-41352", "first_seen_at": "2026-10-23T22:29:04+00:00"}]
---

# synacor zimbra collaboration suite: An issue was discovered in Zimbra Collaboration (ZCS) 8.8.15 and 9.0

Zimbra Collaboration Suite has an arbitrary file upload flaw in its cpio package handling. An attacker can upload files and gain access to other users' accounts.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:Synacor Zimbra Collaboration Suite (ZCS) affected ? fixed ?
- vendor:synacor zimbra collaboration suite affected = 9.0.0 fixed ?
- vendor:synacor zimbra collaboration suite affected = 8.8.15 fixed ?

## Fix

Apply the vendor's updates per Zimbra instructions; CISA's required action is to apply updates per vendor instructions. Specific fixed versions are unknown from the sources.

## Timeline

- 2026-10-23T19:11:52+00:00 kev https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2022-41352
- 2026-10-23T22:29:04+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2022-41352

## From the sources

An issue was discovered in Zimbra Collaboration (ZCS) 8.8.15 and 9.0. An attacker can upload arbitrary files through amavis via a cpio loophole (extraction to /opt/zimbra/jetty/webapps/zimbra/public) that can lead to incorrect access to any other user accounts. Zimbra recommends pax over cpio. Also, pax is in the prerequisites of Zimbra on Ubuntu; however, pax is no longer part of a default Red Hat installation after RHEL 6 (or CentOS 6). Once pax is installed, amavis automatically prefers it over cpio.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_