A CSS sanitization vulnerability in Zimbra Collaboration Suite (ZCS) allows an authenticated user with Briefcase access to publish a document that displays attacker-controlled content under the Zimbra origin. When processing a stylesheet containing non-ASCII characters, DefangFilter appends the final ASCII segment without sanitizing it. HTML stored as application/x-zimbra-doc can therefore retain CSS URL references that the normal sanitizer removes. An attacker can share a crafted document that loads external resources and displays a credential-collection form using Zimbra's own visual assets. Exploitation requires the victim to open the document in a browser that renders the content type inline; credential theft additionally requires form submission. ZCS 10.1.16 and 10.1.20 are affected.
References
| Link | Resource |
|---|---|
| https://wiki.zimbra.com/wiki/Zimbra_Security_Advisories | Vendor Advisory |
| https://www.rapid7.com/blog/post/ve-breaking-zimbra-identity-boundaries-part-1/ | Exploit Third Party Advisory |
Configurations
History
28 Oct 2026, 21:24
| Type | Values Removed | Values Added |
|---|---|---|
| First Time |
Synacor zimbra Collaboration Suite
Synacor |
|
| References | () https://wiki.zimbra.com/wiki/Zimbra_Security_Advisories - Vendor Advisory | |
| References | () https://www.rapid7.com/blog/post/ve-breaking-zimbra-identity-boundaries-part-1/ - Exploit, Third Party Advisory | |
| CPE | cpe:2.3:a:synacor:zimbra_collaboration_suite:*:*:*:*:*:*:*:* |
23 Oct 2026, 14:17
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2026-10-23 14:17
Updated : 2026-10-28 21:24
NVD link : CVE-2026-93633
Mitre link : CVE-2026-93633
CVE.ORG link : CVE-2026-93633
JSON object : View
Products Affected
synacor
- zimbra_collaboration_suite
CWE
CWE-79
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')