CVE-2026-73573
LowCVSS 3.1Summary
In Zimbra Collaboration (ZCS) before 10.1.17, a path traversal vulnerability exists in the Zimbra Briefcase document editing functionality due to improper validation of the packages parameter. An authenticated attacker can exploit this vulnerability by supplying a crafted path traversal sequence, potentially allowing unauthorized disclosure of sensitive files within the web application directory.
Risk Assessment
The risk includes disclosure of sensitive files, which can lead to confidentiality breach and potentially further attacks. An authenticated attacker can gain access to data they should not have access to.
Recommendation
It is recommended to immediately upgrade Zimbra Collaboration to version 10.1.17 or later. Also thoroughly validate the packages parameter and use secure path handling methods.
Original NVD description (English source)
In Zimbra Collaboration (ZCS) before 10.1.17, a path traversal vulnerability exists in the Zimbra Briefcase document editing functionality due to improper validation of the packages parameter. An authenticated attacker can exploit this vulnerability by supplying a crafted path traversal sequence, potentially allowing unauthorized disclosure of sensitive files within the web application directory.