Zimbra Collaboration Suite (ZCS) Arbitrary File Upload and Remote Code Execution Vulnerability (CVE-2022-41352)
Executive & SecOps Summary
SECOPS ASSESSMENTZimbra Collaboration Suite (ZCS) versions 8.8.15 and 9.0 running on Red Hat-based distributions (RHEL/CentOS) where the 'pax' utility is missing.
Unauthenticated attackers can upload arbitrary files to the web root directory via a cpio path traversal loophole during amavis scanning, leading to full system compromise.
Immediately install the 'pax' utility via the OS package manager or upgrade Zimbra to the latest patched version.
Affected Products & Version Scope
Remediation & Live Workaround Commands
PATCH & WORKAROUND1. Official Patch & Version Upgrade Commands
Apply the official security patches provided by Zimbra to resolve the underlying file extraction handling.
# Clean repository cache and update the Zimbra patch package on RHEL/CentOS
yum clean all
yum update zimbra-patch
# Restart Zimbra services as the zimbra user
su - zimbra -c 'zmcontrol restart'2. Temporary Workaround & Hardening Configuration
If patching cannot be performed immediately, install the 'pax' utility. Once installed, amavis will automatically prefer 'pax' over 'cpio', mitigating the path traversal loophole.
# Install pax on RHEL / CentOS systems
yum install -y pax
# Install pax on Ubuntu / Debian systems (if not already present)
apt-get update && apt-get install -y pax
# Restart the amavis service to apply changes
su - zimbra -c 'zmamavisdctl restart'3. Log Audit & IoC Verification Commands
Inspect the Zimbra public web directory for unauthorized JSP files and verify if the system is currently using the vulnerable fallback.
# 1. Verify if pax is installed on the system
which pax || echo 'WARNING: pax is missing! The system is vulnerable if running affected ZCS.'
# 2. Scan the Zimbra public directory for recently created JSP files or web shells
find /opt/zimbra/jetty/webapps/zimbra/public/ -name '*.jsp' -mtime -30 -ls
# 3. Search mail logs for suspicious cpio extraction activities
grep -i 'cpio' /var/log/zimbra.logBlock Exploits Instantly with Managed Virtual Patching Rules
Can't patch production immediately? Deploy managed WAF rules at the edge to intercept RCE, SQLi, and deserialization payloads before they hit your origin server.
Technical Root Cause & Exploitation Mechanics
1. Vulnerability Overview & Root Cause
This vulnerability exists in the mail security filter component (amavis) of Zimbra Collaboration Suite (ZCS). When amavis processes incoming email attachments, it extracts archives using system utilities. If the 'pax' utility is not installed on the host operating system, amavis falls back to using 'cpio'. Since RHEL/CentOS 6 and later versions do not include 'pax' in their default installations, many deployments default to 'cpio'. The 'cpio' utility contains a path traversal loophole that fails to restrict extraction paths, allowing files to be written outside the intended directory.
2. Exploitation Mechanics & Attack Scenario
An attacker sends an email containing a maliciously crafted archive (such as a .tar or .cpio file) as an attachment. When the Zimbra server receives the email, amavis automatically extracts the attachment to scan for spam or malware. Lacking 'pax', amavis invokes 'cpio'. The path traversal payload inside the archive (e.g., '../../../../opt/zimbra/jetty/webapps/zimbra/public/shell.jsp') is processed by cpio, writing a web shell directly into Zimbra's public web directory. The attacker can then access this web shell via HTTP to execute arbitrary commands with Zimbra privileges.
3. Infrastructure & Business Impact
With a CVSS score of 9.8, this vulnerability poses a critical risk and has been actively exploited in the wild (listed in CISA KEV). Successful exploitation grants unauthorized attackers full access to the mail server, enabling them to harvest user credentials, access sensitive email databases, and pivot deeper into the internal corporate network.
Official Vendor Advisories & References
An issue was discovered in Zimbra Collaboration (ZCS) 8.8.15 and 9.0. An attacker can upload arbitrary files through amavis via a cpio loophole (extraction to /opt/zimbra/jetty/webapps/zimbra/public) that can lead to incorrect access to any other user accounts. Zimbra recommends pax over cpio. Also, pax is in the prerequisites of Zimbra on Ubuntu; however, pax is no longer part of a default Red Hat installation after RHEL 6 (or CentOS 6). Once pax is installed, amavis automatically prefers it over cpio.
Frequently Asked SecOps Questions (CVE-2022-41352)
FAQQ1. How critical is CVE-2022-41352 and is it actively exploited in the wild?
CVE-2022-41352 is rated CVSS 9.8 (CRITICAL) with a 30-day EPSS exploitation probability of 95.5%. It is listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, requiring immediate emergency remediation.
Q2. Which vendors and products are affected by CVE-2022-41352?
Primary impacted vendors include zimbra across zimbra_collaboration_suite. Scope summary: Zimbra Collaboration Suite (ZCS) versions 8.8.15 and 9.0, particularly on RHEL/CentOS-based deployments lacking the 'pax' package.
Q3. What temporary mitigations or workarounds exist for CVE-2022-41352 before patching?
[Mitigation] Immediately install the 'pax' utility via the OS package manager or upgrade Zimbra to the latest patched version. Follow the CLI remediation commands and interactive SecOps checklist on this page to restrict exposure prior to your maintenance window.
Generate an Internal Engineering Notice or CISO Report for CVE-2022-41352
Instantly format this advisory into an executive CISO summary or engineering patch ticket.
🔗 Related Advisories in Similar Stack (zimbra)
View Category →Zimbra Collaboration Suite (ZCS) Remote Code Execution Vulnerability Advisory (CVE-2026-73570, CISA KEV Listed)
[Affected Scope] Zimbra Collaboration (ZCS) versions prior to 10.1.20, specifically when the optional zimbra-snmp package is installed and SNMP notifications are enabled.
Adobe ColdFusion Path Traversal Remote Code Execution Vulnerability Urgent Advisory (CVE-2026-48282)
[Affected Scope] Adobe ColdFusion versions 2025.9, 2023.20 and earlier
WebDyne Perl Framework Path Traversal and Remote Code Execution (RCE) Vulnerability Advisory (CVE-2026-78189)
[Affected Scope] Perl web applications utilizing WebDyne versions 3.007 through 3.021
Ahsay AhsayCBS Replication Receiver Remote Code Execution (RCE) Vulnerability Advisory (CVE-2026-105134)
[Affected Scope] AhsayCBS versions up to 9.15.2.69 and 10.3.4.44, specifically the Replication Receiver component
Subscribe to Daily Vulnerability Briefings & KEV Alerts
Concise morning briefings for SecOps, DevSecOps, and SRE teams covering newly exploited CVEs and mitigation priorities.