Live › vulnerability › CVE-2026-93633
Go to dashboardZimbra Collaboration Suite fails to sanitize the last ASCII segment of a stylesheet that contains non-ASCII characters, so a crafted Briefcase document keeps CSS URL references. An attacker can share the document to load external resources and show a fake login form under the Zimbra origin to collect credentials.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Only Zimbra Collaboration Suite installs on the affected 10.1.16 and 10.1.20 releases are exposed, and the attacker must hold a Briefcase account on that server. Teams on other ZCS versions or on hosted Zimbra can skip it, though the sources do not confirm the fixed release.
No product ranges from the sources yet.
su - zimbra -c "zmcontrol -v", and see whether it is 10.1.16 or 10.1.2010.1.16 and 10.1.20 releases; the sources do not name the fixed versionEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
A CSS sanitization vulnerability in Zimbra Collaboration Suite (ZCS) allows an authenticated user with Briefcase access to publish a document that displays attacker-controlled content under the Zimbra origin. When processing a stylesheet containing non-ASCII characters, DefangFilter appends the final ASCII segment without sanitizing it. HTML stored as application/x-zimbra-doc can therefore retain CSS URL references that the normal sanitizer removes. An attacker can share a crafted document that loads external resources and displays a credential-collection form using Zimbra's own visual assets. Exploitation requires the victim to open the document in a browser that renders the content type inline; credential theft additionally requires form submission. ZCS 10.1.16 and 10.1.20 are affected.
This page as .md · .json · in your agent: get_signal("CVE-2026-93633")
NVD data is provided by NIST and is public domain · EPSS scores by FIRST, used with attribution. Posts quoted belong to their authors.