Back to CVE Browser

CVE-2022-37042

🔥 Known Exploited (CISA KEV)CRITICAL

9.8

CVSS Severity Score

EPSS Score0.0000%

EPSS Percentile0.00th

Published2022-08-12

Last Modified2026-06-17

Data SourcesNVDCISA KEV

Vulnerability Description

Zimbra Collaboration Suite (ZCS) 8.8.15 and 9.0 has mboximport functionality that receives a ZIP archive and extracts files from it. By bypassing authentication (i.e., not having an authtoken), an attacker can upload arbitrary files to the system, leading to directory traversal and remote code execution. NOTE: this issue exists because of an incomplete fix for CVE-2022-27925.

Affected Platforms (CPE)

📦

Synacor

Zimbra Collaboration Suite

= 8.8.15= 9.0.0

References & Advisories

🔗 http://packetstormsecurity.com/files/168146/Zimbra-Zip-Path-Traversal.html

🔗 https://wiki.zimbra.com/wiki/Security_Center

🔗 https://wiki.zimbra.com/wiki/Zimbra_Security_Advisories

🔗 http://packetstormsecurity.com/files/168146/Zimbra-Zip-Path-Traversal.html

🔗 https://wiki.zimbra.com/wiki/Security_Center

🔗 https://wiki.zimbra.com/wiki/Zimbra_Security_Advisories

🔗 https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2022-37042

Related Vulnerabilities

CVE-2026-611427.7

Vulnerability in the Oracle Payroll product of Oracle E-Business Suite (component: Internal Operations). Supported versions that ...

CVE-2026-611417.5

Vulnerability in the Oracle Advanced Benefits product of Oracle E-Business Suite (component: Affordable Care Act). Supported vers...

CVE-2026-611387.5

Vulnerability in the Oracle Complex Maintenance, Repair and Overhaul product of Oracle E-Business Suite (component: Internal Opera...

CVE-2026-611257.7

Vulnerability in the Oracle Configure to Order product of Oracle E-Business Suite (component: Supply to Order Workbench). Support...