An issue was discovered in Zimbra Collaboration (ZCS) 9.0 and 10.0 and 10.1.
Affects the Zimbra Classic Web Client in Zimbra Collaboration (ZCS) 9.0, 10.0 and 10.1. CVSS rates it medium (5.4). The checked facts do not name a fixed version.
- Published
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Listed in CISA KEV
- How many real-world setups can hit the bug, from the vendor's advisory and CISA data. It does not know your setup.What do these mean? →
- Actively exploited
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
Summary
Zimbra Collaboration (ZCS) email server's Classic Web Client is affected. A stored cross-site scripting flaw allows an attacker to run malicious scripts in a victim's browser session by sending an email with a specially crafted calendar attachment, which could let the attacker take unauthorized actions such as redirecting email or stealing data from the victim's account.
Summarized by anthropic/claude-haiku-5.5. Verify details against the original sources.
Read the original description
An issue was discovered in Zimbra Collaboration (ZCS) 9.0 and 10.0 and 10.1. A stored cross-site scripting (XSS) vulnerability exists in the Classic Web Client due to insufficient sanitization of HTML content in ICS files. When a user views an e-mail message containing a malicious ICS entry, its embedded JavaScript executes via an ontoggle event inside a <details> tag. This allows an attacker to run arbitrary JavaScript within the victim's session, potentially leading to unauthorized actions such as setting e-mail filters to redirect messages to an attacker-controlled address. As a result, an attacker can perform unauthorized actions on the victim's account, including e-mail redirection and data exfiltration.
Timeline
- CVE published
- Added to CISA KEV
CISA has evidence of exploitation in the wild
- CISA remediation deadline
Due date for US federal agencies to patch
- Record last updated
Affected versions
- n/a n/a
Version range not reported
References 4
Questions about CVE-2025-27915
What does this mean?
The bug is stored cross-site scripting in the Zimbra Classic Web Client. Script can run in a user's session.Source: wiki.zimbra.com, wiki.zimbra.com
Am I affected, and how do I check?
The advisory describes Zimbra Collaboration (ZCS) 9.0, 10.0 and 10.1, and the issue is specific to the Classic Web Client. Compare the installed ZCS version against these and check whether the Classic Web Client is in use. The checked facts do not give a specific version command or setting.Source: wiki.zimbra.com, wiki.zimbra.com
What should I do about it?
The checked facts do not name a fixed version. The source text refers to a patch that fixes the issue, so the vendor's patch for the installed ZCS version is the step the facts support.Source: wiki.zimbra.com, wiki.zimbra.com
Is it being exploited?
Yes. CISA added it to its Known Exploited Vulnerabilities catalog on 2025-10-07, which means it has evidence of attacks. No public exploit code is tracked.Source: cisa.gov, cve.now feed data
What if there's no patch?
The checked facts list no workaround. The only limit they support is restricting use of the Classic Web Client, the affected component.Source: wiki.zimbra.com, wiki.zimbra.com