Zimbra Collaboration Suite (ZCS) mboximport Directory Traversal and Remote Code Execution Vulnerability (CVE-2022-27925)
Executive & SecOps Summary
SECOPS ASSESSMENTZimbra Collaboration Suite (ZCS) versions 8.8.15 and 9.0
An authenticated administrator can upload a malicious ZIP archive to write arbitrary files, leading to Remote Code Execution (RCE)
Immediately apply the official Zimbra security patches (9.0.0 Patch 24 / 8.8.15 Patch 31 or later)
Affected Products & Version Scope
Remediation & Live Workaround Commands
PATCH & WORKAROUND1. Official Patch & Version Upgrade Commands
Configure the official Zimbra repository and upgrade the core packages to the patched versions (9.0.0 Patch 24 / 8.8.15 Patch 31 or later).
# For RedHat/CentOS systems
sudo yum clean all
sudo yum update zimbra-core zimbra-store -y
# For Ubuntu/Debian systems
sudo apt-get update
sudo apt-get --only-upgrade install zimbra-core zimbra-store -y
# Restart Zimbra services
su - zimbra -c 'zmcontrol restart'2. Temporary Workaround & Hardening Configuration
If immediate patching is not feasible, restrict external access to the Zimbra administration console (default port 7071) and block external requests to the mboximport endpoint using a reverse proxy.
# Add to your Nginx configuration file
server {
listen 80;
listen 443 ssl;
server_name mail.yourdomain.com;
# Block external access to the mboximport endpoint
location ~* /service/extension/mboximport {
allow 127.0.0.1;
allow 10.0.0.0/8; # Internal trusted network
deny all;
}
}3. Log Audit & IoC Verification Commands
Inspect the Zimbra web directory for unauthorized JSP files and search the mailbox logs for suspicious mboximport activity.
# 1. Search for recently created or modified JSP files in the web directory
find /opt/zimbra/jetty/webapps/ -name '*.jsp' -mtime -30 -ls
# 2. Scan mailbox.log for mboximport requests containing directory traversal patterns
grep -i 'mboximport' /opt/zimbra/log/mailbox.log | grep -E '\.\./|%2e%2e'Block Exploits Instantly with Managed Virtual Patching Rules
Can't patch production immediately? Deploy managed WAF rules at the edge to intercept RCE, SQLi, and deserialization payloads before they hit your origin server.
Technical Root Cause & Exploitation Mechanics
1. Vulnerability Overview & Root Cause
This vulnerability (CVE-2022-27925) exists in the mboximport functionality of Zimbra Collaboration Suite (ZCS), which is designed to extract uploaded ZIP archives. The root cause is the lack of proper validation and sanitization of file paths contained within the uploaded ZIP archive. This allows directory traversal sequences (../) within the archive's file headers to bypass restrictions, enabling arbitrary file extraction to unintended directories on the host system (CWE-22).
2. Exploitation Mechanics & Attack Scenario
An authenticated attacker with administrative privileges crafts a malicious ZIP archive containing files with relative path traversal sequences (e.g., ../../../../opt/zimbra/jetty/webapps/zimbra/shell.jsp). When this archive is uploaded to the mboximport endpoint, the extraction process writes the payload directly into the web application's root directory. The attacker can then access the uploaded JSP web shell via a web browser to execute arbitrary operating system commands with the privileges of the Zimbra user.
3. Infrastructure & Business Impact
This vulnerability is listed in the CISA KEV (Known Exploited Vulnerabilities) catalog and carries an EPSS score of 0.9868, indicating active exploitation in the wild. Successful exploitation allows complete compromise of the mail server, leading to unauthorized access to sensitive corporate communications, data exfiltration, and potential lateral movement within the internal network.
Official Vendor Advisories & References
Zimbra Collaboration (aka ZCS) 8.8.15 and 9.0 has mboximport functionality that receives a ZIP archive and extracts files from it. An authenticated user with administrator rights has the ability to upload arbitrary files to the system, leading to directory traversal.
Frequently Asked SecOps Questions (CVE-2022-27925)
FAQQ1. How critical is CVE-2022-27925 and is it actively exploited in the wild?
CVE-2022-27925 is rated CVSS 7.2 (HIGH) with a 30-day EPSS exploitation probability of 98.7%. It is listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, requiring immediate emergency remediation.
Q2. Which vendors and products are affected by CVE-2022-27925?
Primary impacted vendors include synacor, zimbra across zimbra_collaboration_suite. Scope summary: Zimbra Collaboration Suite (ZCS) versions 8.8.15 and 9.0 (unpatched)
Q3. What temporary mitigations or workarounds exist for CVE-2022-27925 before patching?
[Mitigation] Immediately apply the official Zimbra security patches (9.0.0 Patch 24 / 8.8.15 Patch 31 or later) Follow the CLI remediation commands and interactive SecOps checklist on this page to restrict exposure prior to your maintenance window.
Generate an Internal Engineering Notice or CISO Report for CVE-2022-27925
Instantly format this advisory into an executive CISO summary or engineering patch ticket.
🔗 Related Advisories in Similar Stack (synacor)
View Category →Zimbra Collaboration Suite (ZCS) Remote Code Execution Vulnerability Advisory (CVE-2026-73570, CISA KEV Listed)
[Affected Scope] Zimbra Collaboration (ZCS) versions prior to 10.1.20, specifically when the optional zimbra-snmp package is installed and SNMP notifications are enabled.
Adobe ColdFusion Path Traversal Remote Code Execution Vulnerability Urgent Advisory (CVE-2026-48282)
[Affected Scope] Adobe ColdFusion versions 2025.9, 2023.20 and earlier
WebDyne Perl Framework Path Traversal and Remote Code Execution (RCE) Vulnerability Advisory (CVE-2026-78189)
[Affected Scope] Perl web applications utilizing WebDyne versions 3.007 through 3.021
Ahsay AhsayCBS Replication Receiver Remote Code Execution (RCE) Vulnerability Advisory (CVE-2026-105134)
[Affected Scope] AhsayCBS versions up to 9.15.2.69 and 10.3.4.44, specifically the Replication Receiver component
Subscribe to Daily Vulnerability Briefings & KEV Alerts
Concise morning briefings for SecOps, DevSecOps, and SRE teams covering newly exploited CVEs and mitigation priorities.