Zimbra Collaboration Suite (ZCS) Webmail Classic UI Local File Inclusion (LFI) Vulnerability (CVE-2025-68645) Security Advisory
Executive & SecOps Summary
SECOPS ASSESSMENTZimbra Collaboration (ZCS) versions 10.0 and 10.1 utilizing the Webmail Classic UI
Unauthenticated remote attackers can exploit the /h/rest endpoint to include and execute arbitrary files from the WebRoot directory, potentially leading to sensitive information disclosure and Remote Code Execution (RCE)
Immediately apply the official security patches from Zimbra, or restrict external access to the vulnerable /h/rest endpoint as a temporary workaround
Affected Products & Version Scope
Remediation & Live Workaround Commands
PATCH & WORKAROUND1. Official Patch & Version Upgrade Commands
Refer to the official Zimbra Security Center to obtain and apply the latest security patches. Use the following commands to update the package repository and upgrade the Zimbra patch package.
# Switch to the zimbra user and check the current version
su - zimbra -c 'zmcontrol -v'
# Update package manager and upgrade zimbra-patch (Ubuntu/Debian)
sudo apt-get update && sudo apt-get --only-upgrade install zimbra-patch
# Update package manager and upgrade zimbra-patch (RHEL/Rocky Linux)
sudo yum clean all && sudo yum update zimbra-patch
# Restart Zimbra services to apply changes
su - zimbra -c 'zmcontrol restart'2. Temporary Workaround & Hardening Configuration
If patching cannot be performed immediately, restrict external access to the vulnerable /h/rest endpoint using Nginx configuration or a Web Application Firewall (WAF).
# Add the following block inside the server context of your Zimbra Nginx templates
# (e.g., /opt/zimbra/conf/nginx/templates/nginx.conf.web.http.template)
location ~* ^/h/rest {
allow 127.0.0.1;
allow 10.0.0.0/8; # Example trusted internal network
deny all;
proxy_pass http://127.0.0.1:8080;
}3. Log Audit & IoC Verification Commands
Inspect the Nginx access logs and mailbox logs for any suspicious requests targeting the /h/rest endpoint or directory traversal attempts.
# Scan Nginx access logs for suspicious traversal attempts on the /h/rest endpoint
grep -E '/h/rest' /opt/zimbra/log/nginx_access.log | grep -E '(\.\./|\.\.\\)'
# Search mailbox.log for errors or exceptions related to RestFilter
grep -i 'RestFilter' /opt/zimbra/log/mailbox.log | grep -E -i '(fail|error|exception|invalid)'Block Exploits Instantly with Managed Virtual Patching Rules
Can't patch production immediately? Deploy managed WAF rules at the edge to intercept RCE, SQLi, and deserialization payloads before they hit your origin server.
Technical Root Cause & Exploitation Mechanics
1. Vulnerability Overview & Root Cause
A Local File Inclusion (LFI) vulnerability (CVE-2025-68645) exists in the Webmail Classic UI of Zimbra Collaboration Suite (ZCS) versions 10.0 and 10.1. The root cause of this vulnerability lies in the improper handling and sanitization of user-supplied request parameters within the RestFilter servlet. Because the input is not adequately validated before being processed by the internal request dispatching mechanism, an attacker can manipulate the path resolution logic.
2. Exploitation Mechanics & Attack Scenario
An unauthenticated remote attacker can craft malicious HTTP requests targeting the /h/rest endpoint. By injecting directory traversal sequences or specific file paths into the request parameters, the attacker influences the internal request dispatching process. This allows the inclusion of arbitrary files residing within the WebRoot directory. If an attacker successfully uploads or identifies a controllable file within the WebRoot, this LFI can be chained to execute arbitrary code under the context of the Zimbra application process.
3. Infrastructure & Business Impact
With a CVSS score of 8.8 (High) and its active status in the CISA Known Exploited Vulnerabilities (KEV) catalog, this vulnerability poses an immediate threat to enterprise mail infrastructure. Successful exploitation can lead to the exposure of sensitive configuration files, credentials, and proprietary data. Furthermore, full compromise of the mail server allows attackers to intercept communications, distribute spam/phishing campaigns, or pivot deeper into the internal corporate network.
Official Vendor Advisories & References
A Local File Inclusion (LFI) vulnerability exists in the Webmail Classic UI of Zimbra Collaboration (ZCS) 10.0 and 10.1 because of improper handling of user-supplied request parameters in the RestFilter servlet. An unauthenticated remote attacker can craft requests to the /h/rest endpoint to influence internal request dispatching, allowing inclusion of arbitrary files from the WebRoot directory.
Frequently Asked SecOps Questions (CVE-2025-68645)
FAQQ1. How critical is CVE-2025-68645 and is it actively exploited in the wild?
CVE-2025-68645 is rated CVSS 8.8 (HIGH) with a 30-day EPSS exploitation probability of 48.9%. It is listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, requiring immediate emergency remediation.
Q2. Which vendors and products are affected by CVE-2025-68645?
Primary impacted vendors include zimbra across zimbra collaboration suite. Scope summary: Zimbra Collaboration Suite (ZCS) versions 10.0 and 10.1 (Webmail Classic UI enabled)
Q3. What temporary mitigations or workarounds exist for CVE-2025-68645 before patching?
[Mitigation] Immediately apply the official security patches from Zimbra, or restrict external access to the vulnerable /h/rest endpoint as a temporary workaround Follow the CLI remediation commands and interactive SecOps checklist on this page to restrict exposure prior to your maintenance window.
Generate an Internal Engineering Notice or CISO Report for CVE-2025-68645
Instantly format this advisory into an executive CISO summary or engineering patch ticket.
🔗 Related Advisories in Similar Stack (zimbra)
View Category →Zimbra Collaboration Suite (ZCS) Remote Code Execution Vulnerability Advisory (CVE-2026-73570, CISA KEV Listed)
[Affected Scope] Zimbra Collaboration (ZCS) versions prior to 10.1.20, specifically when the optional zimbra-snmp package is installed and SNMP notifications are enabled.
WordPress Core get_page_template() Local File Inclusion (LFI) and Remote Code Execution (RCE) (CVE-2026-87902)
[Affected Scope] All WordPress installations running vulnerable core versions and specific themes.
DedeCMS Local File Inclusion (LFI) Vulnerability in carbuyaction.php (CVE-2010-20125)
[Affected Scope] All DedeCMS installations prior to version 5.7
Ahsay AhsayCBS Replication Receiver Remote Code Execution (RCE) Vulnerability Advisory (CVE-2026-105134)
[Affected Scope] AhsayCBS versions up to 9.15.2.69 and 10.3.4.44, specifically the Replication Receiver component
Subscribe to Daily Vulnerability Briefings & KEV Alerts
Concise morning briefings for SecOps, DevSecOps, and SRE teams covering newly exploited CVEs and mitigation priorities.