{"id":"CVE-2026-93630","kind":"vulnerability","aliases":["CVE-2026-93630"],"related":[],"title":"Zimbra: email sanitizer lets crafted forms reach the mail host","description":"A hostname canonicalization vulnerability in the email HTML sanitizers of Zimbra Collaboration Suite (ZCS) allows an unauthenticated sender to bypass the restriction on forms that target the Zimbra host. DefangFilter and the OWASP ActionAttributePolicy compare the form-action hostname with the request hostname before browser URL canonicalization. A percent-encoded hostname can therefore survive sanitization while the browser submits the form to the normal Zimbra origin with the recipient's authentication cookie. This permits authenticated form requests from a crafted email after the recipient opens it in Classic and submits the form. The issue is present in ZCS 10.1.16 and 10.1.21. It does not bypass an endpoint's CSRF-token checks; a state-changing attack additionally requires an endpoint that accepts the resulting request without that protection.","summary":"Zimbra Collaboration Suite's email HTML sanitizers compare form-action hostnames before browser URL decoding, so a percent-encoded hostname can survive filtering. A crafted email can then make a recipient's browser submit a form to the Zimbra origin with their session cookie, if they open it in Classic and submit the form.","severity":"medium","cvss":4.3,"epss":0.00411,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["email","infrastructure","self-hosted","zimbra"],"not_affected_if":["managed-hosting","webmail-not-classic"],"how_to_check":"- Check the installed ZCS version with `su - zimbra -c \"zmcontrol -v\"`; the sources name 10.1.16 and 10.1.21 as affected.\n- unknown whether other versions are affected; the sources do not say.","fix":"- Upgrade Zimbra Collaboration Suite to a release that includes the fix; the target version is unknown in the sources.\n- Check Zimbra's vendor advisory for the patched build.","status":"open","published_at":"2026-10-23T14:17:56+00:00","first_seen_at":"2026-10-23T21:57:34+00:00","triaged_at":"2026-10-25T04:37:18+00:00","updated_at":"2026-10-25T12:38:49+00:00","category":"infrastructure","confidence":0.6,"triage":{"at":"2026-10-25T04:37:18Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade Zimbra Collaboration Suite to a release that includes the fix; the target version is unknown in the sources.\n- Check Zimbra's vendor advisory for the patched build.","reach":"internet","title":"Zimbra: email sanitizer lets crafted forms reach the mail host","impact":"medium","summary":"Zimbra Collaboration Suite's email HTML sanitizers compare form-action hostnames before browser URL decoding, so a percent-encoded hostname can survive filtering. A crafted email can then make a recipient's browser submit a form to the Zimbra origin with their session cookie, if they open it in Classic and submit the form.","category":"infrastructure","nicknames":[],"who_cares":["zimbra","self-hosted","email"],"confidence":0.6,"needs_auth":"no","worst_case":"Recipient's session cookie is used for authenticated form requests to Zimbra.","analyst_note":"Find the vendor advisory or NVD references for the patched ZCS build and whether other versions are affected.","how_to_check":"- Check the installed ZCS version with `su - zimbra -c \"zmcontrol -v\"`; the sources name 10.1.16 and 10.1.21 as affected.\n- unknown whether other versions are affected; the sources do not say.","needs_analyst":true,"not_affected_if":["managed-hosting","webmail-not-classic"],"who_is_affected":"Organizations running self-hosted Zimbra Collaboration Suite on the affected versions, where users read mail in the Classic web client. The sources say a state-changing attack also needs an endpoint that accepts the request without CSRF protection, so exposure depends on that as well. Teams on managed Zimbra hosting or other versions can likely skip it, but the sources do not confirm which versions are affected beyond 10.1.16 and 10.1.21.","user_interaction":"yes","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000688,"input_tokens":3517,"output_tokens":673,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-2026':12A,15A '-93630':13A,16A '10.1.16':179C '10.1.21':181C 'accept':203C 'action':33B,117C 'actionattributepolici':112C 'addit':198C 'allow':93C 'attack':197C 'authent':151C,155C 'browser':36B,57B,124C,138C 'bypass':98C,185C 'canonic':81C,126C 'chang':196C 'check':192C 'classic':74B,168C 'collabor':24B,90C 'compar':30B,113C 'cooki':68B,152C 'craft':5A,49B,160C 'csrf':190C 'csrf-token':189C 'cve':11A,14A 'decod':38B 'defangfilt':108C 'email':2A,17B,27B,50B,85C,161C 'encod':43B,130C 'endpoint':187C,201C 'filter':47B 'form':6A,32B,60B,78B,102C,116C,141C,156C,172C 'form-act':31B,115C 'host':10A,21B,107C 'hostnam':34B,44B,80C,118C,122C,131C 'html':28B,86C 'infrastructur':18B 'issu':174C 'let':4A 'mail':9A 'make':53B 'normal':144C 'open':71B,165C 'origin':64B,146C 'owasp':111C 'percent':42B,129C 'percent-encod':41B,128C 'permit':154C 'present':176C 'protect':209C 'reach':7A 'recipi':55B,149C,164C 'request':121C,157C,206C 'requir':199C 'restrict':100C 'result':205C 'sanit':3A,29B,87C,135C 'self':20B 'self-host':19B 'sender':96C 'session':67B 'state':195C 'state-chang':194C 'submit':58B,76B,139C,170C 'suit':25B,91C 'surviv':46B,134C 'target':104C 'therefor':133C 'token':191C 'unauthent':95C 'url':37B,125C 'vulner':82C 'without':207C 'zcs':92C,178C 'zimbra':1A,22B,23B,63B,89C,106C,145C","nicknames":[],"mitigations":[],"who_affected":"Organizations running self-hosted Zimbra Collaboration Suite on the affected versions, where users read mail in the Classic web client. The sources say a state-changing attack also needs an endpoint that accepts the request without CSRF protection, so exposure depends on that as well. Teams on managed Zimbra hosting or other versions can likely skip it, but the sources do not confirm which versions are affected beyond 10.1.16 and 10.1.21.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-23T14:17:56+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N","cvss_by":"cve@rapid7.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-93630","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-93630","severity":null,"published_at":"2026-10-23T14:17:56+00:00","modified_at":"2026-10-23T16:44:17+00:00","first_seen_at":"2026-10-23T21:57:34+00:00","fetched_at":"2026-10-23T22:29:03+00:00","note":null},{"source":"epss","external_id":"CVE-2026-93630","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-93630","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-25T12:38:49+00:00","fetched_at":"2026-10-25T12:38:49+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}