CVE-2026-73574

Published: Aug 13, 2026Modified: Aug 28, 2026

6.5

Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Exploitability: 2.8 / Impact: 3.6

Source: NVD

Description

In Zimbra Collaboration before 10.1.17, a local file inclusion (LFI) vulnerability exists in the Zimbra Classic Web Client due to improper validation of the fu request parameter. An unauthenticated attacker can exploit this vulnerability by supplying a crafted path, potentially allowing unauthorized disclosure of protected files, such as WEB-INF/web.xml, within the web application directory. This occurs in the Forward servlet.

Affected (1)

Products: Synacor: Zimbra Collaboration Suite

1 product

Zimbra Collaboration Suite

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Synacor Zimbra Collaboration Suite	Before 10.1.17

Related CWEs

Incorrect Resource Transfer Between Spheres

The product does not properly transfer a resource/behavior to another sphere, or improperly imports a resource/behavior from another sphere, in a manner that provides unintended control over that resource.

References (2)

https://wiki.zimbra.com/wiki/Zimbra_Responsible_Disclosure_Policy

Source: cve@mitre.org

Vendor Advisory

https://wiki.zimbra.com/wiki/Zimbra_Security_Advisories

Source: cve@mitre.org

Vendor Advisory

Timeline

No history available yet.