{"id":"CVE-2026-93633","kind":"vulnerability","aliases":["CVE-2026-93633"],"related":[],"title":"Zimbra: CSS sanitizer skips final segment, enabling credential-phishing documents","description":"A CSS sanitization vulnerability in Zimbra Collaboration Suite (ZCS) allows an authenticated user with Briefcase access to publish a document that displays attacker-controlled content under the Zimbra origin. When processing a stylesheet containing non-ASCII characters, DefangFilter appends the final ASCII segment without sanitizing it. HTML stored as application/x-zimbra-doc can therefore retain CSS URL references that the normal sanitizer removes. An attacker can share a crafted document that loads external resources and displays a credential-collection form using Zimbra's own visual assets. Exploitation requires the victim to open the document in a browser that renders the content type inline; credential theft additionally requires form submission. ZCS 10.1.16 and 10.1.20 are affected.","summary":"Zimbra Collaboration Suite fails to sanitize the last ASCII segment of a stylesheet that contains non-ASCII characters, so a crafted Briefcase document keeps CSS URL references. An attacker can share the document to load external resources and show a fake login form under the Zimbra origin to collect credentials.","severity":"medium","cvss":5.4,"epss":0.00235,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["email","package","self-hosted","zimbra"],"not_affected_if":["managed-hosting","other-zcs-versions"],"how_to_check":"- Check the installed ZCS version with `su - zimbra -c \"zmcontrol -v\"`, and see whether it is `10.1.16` or `10.1.20`\n- unknown for other checks; the sources do not say how to find affected Briefcase documents","fix":"- Upgrade Zimbra Collaboration Suite past the affected `10.1.16` and `10.1.20` releases; the sources do not name the fixed version\n- unknown for configuration workarounds","status":"open","published_at":"2026-10-23T14:17:57+00:00","first_seen_at":"2026-10-23T21:57:34+00:00","triaged_at":"2026-10-25T04:14:14+00:00","updated_at":"2026-10-25T12:38:49+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-25T04:14:14Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade Zimbra Collaboration Suite past the affected `10.1.16` and `10.1.20` releases; the sources do not name the fixed version\n- unknown for configuration workarounds","reach":"internet","title":"Zimbra: CSS sanitizer skips final segment, enabling credential-phishing documents","impact":"medium","summary":"Zimbra Collaboration Suite fails to sanitize the last ASCII segment of a stylesheet that contains non-ASCII characters, so a crafted Briefcase document keeps CSS URL references. An attacker can share the document to load external resources and show a fake login form under the Zimbra origin to collect credentials.","category":"package","nicknames":[],"who_cares":["zimbra","self-hosted","email"],"confidence":0.6,"needs_auth":"yes","worst_case":"Attacker gets a credential-phishing form on the Zimbra origin","analyst_note":"Find the NVD fixed version for ZCS 10.1.16 and 10.1.20 and the Zimbra advisory at https://nvd.nist.gov/vuln/detail/CVE-2026-93633.","how_to_check":"- Check the installed ZCS version with `su - zimbra -c \"zmcontrol -v\"`, and see whether it is `10.1.16` or `10.1.20`\n- unknown for other checks; the sources do not say how to find affected Briefcase documents","needs_analyst":true,"not_affected_if":["other-zcs-versions","managed-hosting"],"who_is_affected":"Only Zimbra Collaboration Suite installs on the affected 10.1.16 and 10.1.20 releases are exposed, and the attacker must hold a Briefcase account on that server. Teams on other ZCS versions or on hosted Zimbra can skip it, though the sources do not confirm the fixed release.","user_interaction":"yes","needs_special_setup":"no","severity_if_unknown":"medium"},"cost_usd":0.000684,"input_tokens":3490,"output_tokens":669,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-2026':13A,16A '-93633':14A,17A '10.1.16':186C '10.1.20':188C 'access':90C 'addit':181C 'affect':190C 'allow':84C 'append':115C 'application/x-zimbra-doc':126C 'ascii':32B,41B,112C,118C 'asset':161C 'attack':53B,98C,139C 'attacker-control':97C 'authent':86C 'briefcas':46B,89C 'browser':172C 'charact':42B,113C 'collabor':25B,81C 'collect':73B,154C 'contain':38B,109C 'content':100C,176C 'control':99C 'craft':45B,143C 'credenti':9A,74B,153C,179C 'credential-collect':152C 'credential-phish':8A 'css':2A,49B,76C,130C 'cve':12A,15A 'defangfilt':114C 'display':96C,150C 'document':11A,47B,57B,94C,144C,169C 'email':18B 'enabl':7A 'exploit':162C 'extern':60B,147C 'fail':27B 'fake':65B 'final':5A,117C 'form':67B,155C,183C 'host':22B 'html':123C 'inlin':178C 'keep':48B 'last':31B 'load':59B,146C 'login':66B 'non':40B,111C 'non-ascii':39B,110C 'normal':135C 'open':167C 'origin':71B,104C 'packag':19B 'phish':10A 'process':106C 'publish':92C 'refer':51B,132C 'remov':137C 'render':174C 'requir':163C,182C 'resourc':61B,148C 'retain':129C 'sanit':3A,29B,77C,121C,136C 'segment':6A,33B,119C 'self':21B 'self-host':20B 'share':55B,141C 'show':63B 'skip':4A 'store':124C 'stylesheet':36B,108C 'submiss':184C 'suit':26B,82C 'theft':180C 'therefor':128C 'type':177C 'url':50B,131C 'use':156C 'user':87C 'victim':165C 'visual':160C 'vulner':78C 'without':120C 'zcs':83C,185C 'zimbra':1A,23B,24B,70B,80C,103C,157C","nicknames":[],"mitigations":[],"who_affected":"Only Zimbra Collaboration Suite installs on the affected 10.1.16 and 10.1.20 releases are exposed, and the attacker must hold a Briefcase account on that server. Teams on other ZCS versions or on hosted Zimbra can skip it, though the sources do not confirm the fixed release.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-23T14:17:57+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","cvss_by":"cve@rapid7.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-93633","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-93633","severity":null,"published_at":"2026-10-23T14:17:57+00:00","modified_at":"2026-10-23T16:44:17+00:00","first_seen_at":"2026-10-23T21:57:34+00:00","fetched_at":"2026-10-23T22:29:03+00:00","note":null},{"source":"epss","external_id":"CVE-2026-93633","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-93633","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-25T12:38:49+00:00","fetched_at":"2026-10-25T12:38:49+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}