---
id: "CVE-2025-27915"
kind: "vulnerability"
aliases: ["CVE-2025-27915"]
title: "synacor zimbra collaboration suite: An issue was discovered in Zimbra Collaboration (ZCS) 9.0 and 10.0 and 10.1"
severity: "high"
cvss: 5.4
epss: null
exploited: true
status: "open"
category: "vendor"
products: [{"name": "Synacor Zimbra Collaboration Suite (ZCS)", "fixed": [], "affected": "", "ecosystem": "vendor"}, {"name": "synacor zimbra collaboration suite", "fixed": ["10.0.13"], "affected": ">= 10.0.0, < 10.0.13", "ecosystem": "vendor"}, {"name": "synacor zimbra collaboration suite", "fixed": ["10.1.5"], "affected": ">= 10.1.0, < 10.1.5", "ecosystem": "vendor"}, {"name": "synacor zimbra collaboration suite", "fixed": [], "affected": "= 9.0.0", "ecosystem": "vendor"}]
ecosystems: ["vendor"]
tags: ["email", "exploited", "self-hosted", "vendor", "zimbra"]
not_affected_if: ["managed-hosting"]
published_at: "2025-03-12T15:15:39+00:00"
first_seen_at: "2026-10-23T19:11:51+00:00"
updated_at: "2026-10-23T23:44:51+00:00"
sources: [{"source": "kev", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2025-27915", "first_seen_at": "2026-10-23T19:11:51+00:00"}, {"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-27915", "first_seen_at": "2026-10-23T23:44:51+00:00"}]
---

# synacor zimbra collaboration suite: An issue was discovered in Zimbra Collaboration (ZCS) 9.0 and 10.0 and 10.1

Zimbra Collaboration Suite's Classic Web Client does not sanitize HTML in ICS calendar attachments, so a crafted email runs attacker JavaScript when the victim opens it. The script runs in the victim's session and can set mail filters to forward messages to an attacker address and exfiltrate data.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:Synacor Zimbra Collaboration Suite (ZCS) affected ? fixed ?
- vendor:synacor zimbra collaboration suite affected >= 10.0.0, < 10.0.13 fixed 10.0.13
- vendor:synacor zimbra collaboration suite affected >= 10.1.0, < 10.1.5 fixed 10.1.5
- vendor:synacor zimbra collaboration suite affected = 9.0.0 fixed ?

## Fix

Apply the mitigations from Synacor/Zimbra vendor instructions (CISA KEV entry, no version given in sources); if mitigations are unavailable, discontinue use of the product per CISA guidance.

## Timeline

- 2026-10-23T19:11:51+00:00 kev https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2025-27915
- 2026-10-23T23:44:51+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2025-27915

## From the sources

Synacor Zimbra Collaboration Suite (ZCS) contains a cross-site scripting vulnerability that exists in the Classic Web Client due to insufficient sanitization of HTML content in ICS files. When a user views an e-mail message containing a malicious ICS entry, its embedded JavaScript executes via an ontoggle event inside a tag. This allows an attacker to run arbitrary JavaScript within the victim's session, potentially leading to unauthorized actions such as setting e-mail filters to redirect messages to an attacker-controlled address. As a result, an attacker can perform unauthorized actions on the victim's account, including e-mail redirection and data exfiltration.

CISA required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_