← Back

CVE-2026-33371

nvd nist
Published: Mar 20, 2026Modified: Jun 17, 2026

JSON object

Loading...
4.3
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Exploitability: 2.8 / Impact: 1.4
Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0 (Secondary)

Description

An issue was discovered in Zimbra Collaboration (ZCS) 10.0 and 10.1. An XML External Entity (XXE) vulnerability exists in the Zimbra Exchange Web Services (EWS) SOAP interface due to improper handling of XML input. An authenticated attacker can submit crafted XML data that is processed by an XML parser with external entity resolution enabled. Successful exploitation may allow disclosure of sensitive local files from the server.

Affected (1)

Synacor
1 product
Zimbra Collaboration Suite
Configuration A
1 vulnerable
Vulnerable SoftwareAffected Versions
Zimbra Collaboration Suite
From 10.0.0 to 10.1.16

Related CWEs

CWE-611
Improper Restriction of XML External Entity Reference
The product processes an XML document that can contain XML entities with URIs that resolve to documents outside of the intended sphere of control, causing the product to embed incorrect documents into its output.

References (4)

Source: cve@mitre.org
Release NotesVendor Advisory
Source: cve@mitre.org
Release Notes
Source: cve@mitre.org
Product
Source: cve@mitre.org
Vendor Advisory

Timeline

No history available yet.