Zimbra Collaboration Suite (ZCS) Classic UI Stored XSS Vulnerability Advisory (CVE-2025-66376)

1. Apply Official Security Patches

Upgrade your Zimbra Collaboration Suite instance to the latest secure releases:

• ZCS 10.0 Users: Upgrade to version 10.0.18 or later.
• ZCS 10.1 Users: Upgrade to version 10.1.13 or later.

2. Temporary Mitigation via WAF / Email Gateway

If immediate patching is not feasible, configure your Web Application Firewall (WAF) or Secure Email Gateway (SEG) to inspect and block incoming HTML emails containing suspicious CSS @import directives.

Example Snort/Suricata Rule:

alert tcp any any -> any 80 (msg:"Zimbra CSS @import XSS Attempt"; content:"@import"; nocase; content:"stylesheet"; nocase; sid:1000001; rev:1;)

3. User Workaround

Advise users to switch to the Modern UI instead of the Classic UI until the security patch is fully deployed.

This vulnerability (CVE-2025-66376) is a Stored Cross-Site Scripting (XSS) flaw residing in the Classic UI of Zimbra Collaboration Suite (ZCS).

The root cause is the improper sanitization of Cascading Style Sheets (CSS) @import directives within HTML email messages. When an attacker sends an email containing a crafted HTML body with malicious @import rules, the Zimbra mail parser fails to neutralize the input before rendering it in the Classic UI.

Consequently, when an unsuspecting user opens the email, the browser executes arbitrary script code embedded or referenced via the CSS context. This vulnerability is actively exploited in the wild and is listed in the CISA KEV catalog, making immediate remediation critical.