Back to CVE Browser

CVE-2022-27925

🔥 Known Exploited (CISA KEV)HIGH

7.2

CVSS Severity Score

EPSS Score0.0000%

EPSS Percentile0.00th

Published2022-04-21

Last Modified2026-06-17

Data SourcesNVDCISA KEV

Vulnerability Description

Zimbra Collaboration (aka ZCS) 8.8.15 and 9.0 has mboximport functionality that receives a ZIP archive and extracts files from it. An authenticated user with administrator rights has the ability to upload arbitrary files to the system, leading to directory traversal.

Affected Platforms (CPE)

📦

Synacor

Zimbra Collaboration Suite

= 8.8.15= 9.0.0

References & Advisories

🔗 http://packetstormsecurity.com/files/168146/Zimbra-Zip-Path-Traversal.html

🔗 https://wiki.zimbra.com/wiki/Security_Center

🔗 https://wiki.zimbra.com/wiki/Zimbra_Releases/9.0.0/P24

🔗 https://wiki.zimbra.com/wiki/Zimbra_Security_Advisories

🔗 http://packetstormsecurity.com/files/168146/Zimbra-Zip-Path-Traversal.html

🔗 https://wiki.zimbra.com/wiki/Security_Center

🔗 https://wiki.zimbra.com/wiki/Zimbra_Releases/9.0.0/P24

🔗 https://wiki.zimbra.com/wiki/Zimbra_Security_Advisories

Related Vulnerabilities

CVE-2026-611427.7

Vulnerability in the Oracle Payroll product of Oracle E-Business Suite (component: Internal Operations). Supported versions that ...

CVE-2026-611417.5

Vulnerability in the Oracle Advanced Benefits product of Oracle E-Business Suite (component: Affordable Care Act). Supported vers...

CVE-2026-611387.5

Vulnerability in the Oracle Complex Maintenance, Repair and Overhaul product of Oracle E-Business Suite (component: Internal Opera...

CVE-2026-611257.7

Vulnerability in the Oracle Configure to Order product of Oracle E-Business Suite (component: Supply to Order Workbench). Support...