CVE Vulnerability Advisory Database
Filter vulnerabilities by CVSS severity, active CISA KEV exploitation, and technology stack.
Showing 1โ1 of 1 advisories (Page 1/1)
2025-12-22
Zimbra Collaboration Suite (ZCS) Webmail Classic UI Local File Inclusion (LFI) Vulnerability (CVE-2025-68645) Security Advisory
[Affected Scope] Zimbra Collaboration (ZCS) versions 10.0 and 10.1 utilizing the Webmail Classic UI
[Impact] Unauthenticated remote attackers can exploit the /h/rest endpoint to include and execute arbitrary files from the WebRoot directory, potentially leading to sensitive information disclosure and Remote Code Execution (RCE)
[Mitigation] Immediately apply the official security patches from Zimbra, or restrict external access to the vulnerable /h/rest endpoint as a temporary workaround