Live › vulnerability › CVE-2026-66912
A crafted From header in an email can carry JavaScript that runs in the browser of a user who opens the message in Zimbra Classic UI and clicks Reply in HTML mode with reply headers disabled. An attacker could steal the victim's session or act as the victim inside Zimbra.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-29 16:26 UTC. All times on this page are UTC.
Organisations running Zimbra Collaboration with the Classic UI, where users reply to crafted email in HTML composition mode. The sources do not state the exact affected version range. Teams on hosted Zimbra or on a non-Classic interface may not be exposed, though the sources do not confirm this.
No product ranges from the sources yet.
10.1.21 or later (per the NVD description; the affected range is not stated in the sources).Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Zimbra is vulnerable to Stored Cross-Site Scripting (XSS) via the From email header during HTML reply composition in Classic UI. Due to insufficient sanitization of the From header value, a remote attacker can send a crafted email containing a malicious From header with an embedded JavaScript payload. When the victim opens the message in Classic UI and clicks Reply while composing in HTML mode with reply headers disabled, the unsanitized From header content is rendered as HTML and the JavaScript payload executes in the victim's browser, potentially allowing the attacker to steal session information or perform actions on behalf of the victim. This issue was fixed in version 10.1.21
This page as .md · .json · in your agent: get_signal("CVE-2026-66912")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.