← Back

CVE-2025-68645

nvd nistnuclei
Published: Dec 22, 2025Modified: Jun 17, 2026CISA KEV

JSON object

Loading...
8.8
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Exploitability: 2.8 / Impact: 5.9
Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0 (Secondary)

Description

A Local File Inclusion (LFI) vulnerability exists in the Webmail Classic UI of Zimbra Collaboration (ZCS) 10.0 and 10.1 because of improper handling of user-supplied request parameters in the RestFilter servlet. An unauthenticated remote attacker can craft requests to the /h/rest endpoint to influence internal request dispatching, allowing inclusion of arbitrary files from the WebRoot directory.

Affected (2)

Synacor
1 product
Zimbra Collaboration Suite
Configuration A
2 vulnerable
Vulnerable SoftwareAffected Versions
Synacor
Zimbra Collaboration Suite
From 10.0.0 to 10.0.18
Zimbra Collaboration Suite
From 10.1.0 to 10.1.13

Related CWEs

CWE-98
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')
The PHP application receives input from an upstream component, but it does not restrict or incorrectly restricts the input before its usage in "require," "include," or similar functions.

References (3)

Source: cve@mitre.org
Release NotesVendor Advisory
Source: cve@mitre.org
Product
Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0
US Government Resource

Timeline

No history available yet.