CVE-2026-93643
CriticalCVSS 9.8Summary
When OnlyOffice/Document Editing is available, an unauthenticated remote attacker with access to an existing supported public Briefcase document can abuse unsigned save fields to perform path-traversal writes and execute commands as the zimbra user.
Risk Assessment
The attack can lead to full compromise of the Zimbra system, including code execution with zimbra user privileges.
Recommendation
Apply security patches for Zimbra and OnlyOffice, and restrict access to public Briefcase documents.
Other vulnerabilities in Zimbra
See all- CVE-2026-93647Critical
An unauthenticated calendar sender can place active markup in a COUNTER message's From address. Selecting the message in Zimbra Classic triggers stored XSS, allowing the attacker to access mailbox data and act as the victim.
- CVE-2026-93642Critical
An unauthenticated sender can forge a share notification that triggers stored XSS when a signed-in Zimbra Modern recipient clicks Accept Share, allowing the attacker to access mailbox data and act as the victim.
- CVE-2026-93641Critical
An unauthenticated sender can forge a share notification that triggers stored XSS when a signed-in Zimbra Classic recipient clicks Accept Share, allowing the attacker to access mailbox data and act as the victim.
Original NVD description (English source)
When OnlyOffice/Document Editing is available, an unauthenticated remote attacker with access to an existing supported public Briefcase document can abuse unsigned save fields to perform path-traversal writes and execute commands as zimbra.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS