{"id":"CVE-2025-27915","kind":"vulnerability","aliases":["CVE-2025-27915"],"related":[],"title":"synacor zimbra collaboration suite: An issue was discovered in Zimbra Collaboration (ZCS) 9.0 and 10.0 and 10.1","description":"Synacor Zimbra Collaboration Suite (ZCS) contains a cross-site scripting vulnerability that exists in the Classic Web Client due to insufficient sanitization of HTML content in ICS files. When a user views an e-mail message containing a malicious ICS entry, its embedded JavaScript executes via an ontoggle event inside a tag. This allows an attacker to run arbitrary JavaScript within the victim's session, potentially leading to unauthorized actions such as setting e-mail filters to redirect messages to an attacker-controlled address. As a result, an attacker can perform unauthorized actions on the victim's account, including e-mail redirection and data exfiltration.\n\nCISA required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","summary":"Zimbra Collaboration Suite's Classic Web Client does not sanitize HTML in ICS calendar attachments, so a crafted email runs attacker JavaScript when the victim opens it. The script runs in the victim's session and can set mail filters to forward messages to an attacker address and exfiltrate data.","severity":"high","cvss":5.4,"epss":null,"exploited":true,"exploited_at":"2025-10-07T00:00:00+00:00","products":[{"name":"Synacor Zimbra Collaboration Suite (ZCS)","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"synacor zimbra collaboration suite","fixed":["10.0.13"],"affected":">= 10.0.0, < 10.0.13","ecosystem":"vendor"},{"name":"synacor zimbra collaboration suite","fixed":["10.1.5"],"affected":">= 10.1.0, < 10.1.5","ecosystem":"vendor"},{"name":"synacor zimbra collaboration suite","fixed":[],"affected":"= 9.0.0","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["email","exploited","self-hosted","vendor","zimbra"],"not_affected_if":["managed-hosting"],"how_to_check":null,"fix":"Apply the mitigations from Synacor/Zimbra vendor instructions (CISA KEV entry, no version given in sources); if mitigations are unavailable, discontinue use of the product per CISA guidance.","status":"open","published_at":"2025-03-12T15:15:39+00:00","first_seen_at":"2026-10-23T19:11:51+00:00","triaged_at":"2026-10-23T20:44:36+00:00","updated_at":"2026-10-23T23:44:51+00:00","category":"vendor","confidence":0.6,"triage":{"at":"2026-10-23T20:44:36Z","model":"claude-haiku-5-5","output":{"fix":"Apply the mitigations from Synacor/Zimbra vendor instructions (CISA KEV entry, no version given in sources); if mitigations are unavailable, discontinue use of the product per CISA guidance.","reach":"internet","summary":"Zimbra Collaboration Suite's Classic Web Client does not sanitize HTML in ICS calendar attachments, so a crafted email runs attacker JavaScript when the victim opens it. The script runs in the victim's session and can set mail filters to forward messages to an attacker address and exfiltrate data.","category":"vendor","who_cares":["zimbra","self-hosted","email"],"confidence":0.6,"needs_auth":"no","worst_case":"Attacker script runs in victim's mailbox session, redirects mail and exfiltrates data","analyst_note":"Find the vendor advisory and the exact patch or mitigation steps and affected versions; the sources only link the CISA KEV search page.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["managed-hosting"],"user_interaction":"yes","needs_special_setup":"no","severity_if_unknown":"high"},"cost_usd":0.000473,"input_tokens":2747,"output_tokens":397,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-01':220C '-2025':19A,22A '-27915':20A,23A '10.0':15A '10.1':17A '22':219C '9.0':13A 'account':199C 'action':169C,194C,210C 'address':94B,185C 'allow':153C 'appli':211C 'applic':217C 'arbitrari':158C 'attach':62B 'attack':68B,93B,155C,183C,190C 'attacker-control':182C 'bod':218C 'calendar':61B 'cisa':208C 'classic':52B,114C 'client':54B,116C 'cloud':223C 'collabor':3A,11A,49B,100C 'collaboration':26A,31A,35A,39A 'contain':103C,136C 'content':123C 'control':184C 'craft':65B 'cross':106C 'cross-sit':105C 'cve':18A,21A 'data':97B,206C 'discontinu':226C 'discov':8A 'due':117C 'e':133C,174C,202C 'e-mail':132C,173C,201C 'email':41B,66B 'embed':142C 'entri':140C 'event':148C 'execut':144C 'exfiltr':96B,207C 'exist':111C 'exploit':42B 'file':126C 'filter':87B,176C 'follow':216C 'forward':89B 'guidanc':221C 'host':45B 'html':58B,122C 'ic':60B,125C,139C 'includ':200C 'insid':149C 'instruct':215C 'insuffici':119C 'issu':6A 'javascript':69B,143C,159C 'lead':166C 'mail':86B,134C,175C,203C 'malici':138C 'messag':90B,135C,179C 'mitig':212C,232C 'ontoggl':147C 'open':73B 'per':213C 'perform':192C 'potenti':165C 'product':230C 'redirect':178C,204C 'requir':209C 'result':188C 'run':67B,77B,157C 'sanit':57B,120C 'script':76B,108C 'self':44B 'self-host':43B 'servic':224C 'session':82B,164C 'set':85B,172C 'site':107C 'suit':4A,50B,101C 'suite':27A,32A,36A,40A 'synacor':1A,24A,29A,33A,37A,98C 'tag':151C 'unauthor':168C,193C 'unavail':234C 'use':227C 'user':129C 'vendor':46B,214C 'via':145C 'victim':72B,80B,162C,197C 'view':130C 'vulner':109C 'web':53B,115C 'within':160C 'zcs':12A,28A,102C 'zimbra':2A,10A,25A,30A,34A,38A,47B,48B,99C","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2025-03-12T15:15:39+00:00","kev":{"dateAdded":"2025-10-07","dueDate":"2025-10-28","requiredAction":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","knownRansomwareCampaignUse":"Unknown"},"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","cvss_by":"134c704f-9b21-4f2e-91b3-4a467353bcc0","poc_count":0,"sources":[{"source":"kev","external_id":"CVE-2025-27915","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2025-27915","severity":null,"published_at":"2025-10-07T00:00:00+00:00","modified_at":null,"first_seen_at":"2026-10-23T19:11:51+00:00","fetched_at":"2026-10-25T14:39:38+00:00","note":null},{"source":"nvd","external_id":"CVE-2025-27915","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-27915","severity":null,"published_at":"2025-03-12T15:15:39+00:00","modified_at":"2026-06-17T09:04:22+00:00","first_seen_at":"2026-10-23T23:44:51+00:00","fetched_at":"2026-10-23T23:44:51+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}