Live › vulnerability › CVE-2026-93630
Go to dashboardZimbra Collaboration Suite's email HTML sanitizers compare form-action hostnames before browser URL decoding, so a percent-encoded hostname can survive filtering. A crafted email can then make a recipient's browser submit a form to the Zimbra origin with their session cookie, if they open it in Classic and submit the form.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Organizations running self-hosted Zimbra Collaboration Suite on the affected versions, where users read mail in the Classic web client. The sources say a state-changing attack also needs an endpoint that accepts the request without CSRF protection, so exposure depends on that as well. Teams on managed Zimbra hosting or other versions can likely skip it, but the sources do not confirm which versions are affected beyond 10.1.16 and 10.1.21.
No product ranges from the sources yet.
su - zimbra -c "zmcontrol -v"; the sources name 10.1.16 and 10.1.21 as affected.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
A hostname canonicalization vulnerability in the email HTML sanitizers of Zimbra Collaboration Suite (ZCS) allows an unauthenticated sender to bypass the restriction on forms that target the Zimbra host. DefangFilter and the OWASP ActionAttributePolicy compare the form-action hostname with the request hostname before browser URL canonicalization. A percent-encoded hostname can therefore survive sanitization while the browser submits the form to the normal Zimbra origin with the recipient's authentication cookie. This permits authenticated form requests from a crafted email after the recipient opens it in Classic and submits the form. The issue is present in ZCS 10.1.16 and 10.1.21. It does not bypass an endpoint's CSRF-token checks; a state-changing attack additionally requires an endpoint that accepts the resulting request without that protection.
This page as .md · .json · in your agent: get_signal("CVE-2026-93630")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.