Zimbra Collaboration Suite (ZCS) Classic UI Cross-Site Scripting (XSS) Vulnerability (CVE-2025-48700) Security Advisory

1. Apply Official Patches

Refer to the Zimbra Security Center and release notes to apply the latest security patches for your specific version immediately.

2. Temporary Mitigations

If patching cannot be deployed immediately, consider the following workarounds:

• Disable Classic UI / Force Modern UI:

Configure Zimbra to force users to use the Modern UI instead of the vulnerable Classic UI.

  # Force Modern UI for a specific domain via Zimbra Admin CLI
  zmprov md example.com zimbraPrefMailWebClient modern

• Deploy WAF (Web Application Firewall) Rules:

Implement WAF rules to detect and block requests containing suspicious @import directives or script tags targeting Zimbra endpoints.

  # ModSecurity Example Rule
  SecRule REQUEST_URI|ARGS "(?i)(@import|javascript:|expression\()" \
      "id:1000001,phase:2,deny,status:403,log,msg:'Zimbra XSS Exploit Attempt (CVE-2025-48700)'"

This vulnerability (CVE-2025-48700) is a Cross-Site Scripting (XSS) flaw residing in the Classic UI of Zimbra Collaboration Suite (ZCS).

Root Cause Analysis (CWE-79): The issue stems from insufficient sanitization of HTML content within the Zimbra Classic UI. Specifically, the application fails to properly filter crafted HTML tag structures and attribute values that contain an @import directive or other script injection vectors, allowing attackers to bypass existing sanitization mechanisms.

Exploit Mechanics & Impact:

• An attacker sends an email containing a specially crafted HTML payload (e.g., leveraging @import to load external stylesheets that execute scripts).
• The vulnerability is triggered automatically when the victim views the email in the Classic UI, requiring no further user interaction.
• The injected JavaScript executes within the context of the victim's active session, enabling the attacker to steal session cookies, access sensitive mailbox contents, or perform unauthorized actions on behalf of the user.

This vulnerability has been added to the CISA Known Exploited Vulnerabilities (KEV) catalog, indicating active exploitation in the wild. Immediate remediation is highly recommended.