CVE-2025-48700

KEVSynacor Zimbra Collaboration Suite (ZCS) Cross-site Scripting Vulnerability

Description

Synacor Zimbra Collaboration Suite (ZCS) contains a cross-site scripting vulnerability that could allow attackers to execute arbitrary JavaScript within the user's session, potentially leading to unauthorized access to sensitive information.

An issue was discovered in Zimbra Collaboration (ZCS) 8.8.15 and 9.0 and 10.0 and 10.1. A Cross-Site Scripting (XSS) vulnerability in the Zimbra Classic UI allows attackers to execute arbitrary JavaScript within the user's session, potentially leading to unauthorized access to sensitive information. This issue arises from insufficient sanitization of HTML content, specifically involving crafted tag structures and attribute values that include an @import directive and other script injection vectors. The vulnerability is triggered when a user views a crafted e-mail message in the Classic UI, requiring no additional user interaction.

CVSS 3.1 vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

PublishedJun 23, 2025

Last modifiedJun 17, 2026

Added to KEVApr 20, 2026

Remediation dueApr 23, 2026

References

wiki.zimbra.com/wiki/Security_CenterRelease Notes
wiki.zimbra.com/wiki/Zimbra_Responsible_Disclosure_PolicyProduct
wiki.zimbra.com/wiki/Zimbra_Security_AdvisoriesVendor Advisory
cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-48700US Government Resource

0 recent articles mention this CVE

Risk assessment · High

Actively exploited. Patch immediately.

Exploitation: Confirmed in the wild (CISA KEV)
Federal remediation deadline: Overdue by 187 days
CVSS: 6.1 MEDIUM
EPSS (30-day exploit probability): 1.7% · top 23% of all CVEs
Weakness: CWE-79
Attack vector: Network, remotely reachable

Recommended actions

1.Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
2.Treat as emergency change: patch or isolate internet-facing instances first.
3.Review exposure: confirm which instances are reachable from the internet and restrict access until patched.
4.Hunt for compromise: review logs for the disclosure window, not just from the patch date.

Assessment is derived automatically from the live signals above; verify against your own asset inventory.