---
id: "CVE-2026-93630"
kind: "vulnerability"
aliases: ["CVE-2026-93630"]
title: "Zimbra: email sanitizer lets crafted forms reach the mail host"
severity: "medium"
cvss: 4.3
epss: 0.00411
exploited: false
status: "open"
category: "infrastructure"
products: []
ecosystems: []
tags: ["email", "infrastructure", "self-hosted", "zimbra"]
not_affected_if: ["managed-hosting", "webmail-not-classic"]
published_at: "2026-10-23T14:17:56+00:00"
first_seen_at: "2026-10-23T21:57:34+00:00"
updated_at: "2026-10-25T12:38:49+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-93630", "first_seen_at": "2026-10-23T21:57:34+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-93630", "first_seen_at": "2026-10-25T12:38:49+00:00"}]
---

# Zimbra: email sanitizer lets crafted forms reach the mail host

Zimbra Collaboration Suite's email HTML sanitizers compare form-action hostnames before browser URL decoding, so a percent-encoded hostname can survive filtering. A crafted email can then make a recipient's browser submit a form to the Zimbra origin with their session cookie, if they open it in Classic and submit the form.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed ZCS version with `su - zimbra -c "zmcontrol -v"`; the sources name 10.1.16 and 10.1.21 as affected.
- unknown whether other versions are affected; the sources do not say.

## Fix

- Upgrade Zimbra Collaboration Suite to a release that includes the fix; the target version is unknown in the sources.
- Check Zimbra's vendor advisory for the patched build.

## Timeline

- 2026-10-23T21:57:34+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-93630
- 2026-10-25T12:38:49+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2026-93630

## From the sources

A hostname canonicalization vulnerability in the email HTML sanitizers of Zimbra Collaboration Suite (ZCS) allows an unauthenticated sender to bypass the restriction on forms that target the Zimbra host. DefangFilter and the OWASP ActionAttributePolicy compare the form-action hostname with the request hostname before browser URL canonicalization. A percent-encoded hostname can therefore survive sanitization while the browser submits the form to the normal Zimbra origin with the recipient's authentication cookie. This permits authenticated form requests from a crafted email after the recipient opens it in Classic and submits the form. The issue is present in ZCS 10.1.16 and 10.1.21. It does not bypass an endpoint's CSRF-token checks; a state-changing attack additionally requires an endpoint that accepts the resulting request without that protection.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_