CVE-2025-27915
Synacor Zimbra Collaboration Suite (ZCS) Cross-site Scripting Vulnerability
Description
CVE-2025-27915 is a medium-severity stored cross-site scripting (XSS) vulnerability (CVSS 5.4) in Zimbra Collaboration Suite (ZCS) versions 9.0, 10.0, and 10.1. The flaw exists in the Classic Web Client due to insufficient sanitization of HTML content in ICS (iCalendar) files attached to email messages. When a user views an email containing a malicious ICS entry, embedded JavaScript executes through an ontoggle event handler inside a <details> HTML tag. CISA has added this vulnerability to the Known Exploited Vulnerabilities (KEV) catalog with a due date of October 28, 2025, and its EPSS score of 27.69% (96.3rd percentile) reflects a very high exploitation probability.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:NOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| synacor | zimbra collaboration suite | >= 10.0.0, < 10.0.13; >= 10.1.0, < 10.1.5; 9.0.0 |
References
- https://wiki.zimbra.com/wiki/Security_Center(Release Notes)
- https://wiki.zimbra.com/wiki/Zimbra_Releases/10.0.13#Security_Fixes(Release Notes)
- https://wiki.zimbra.com/wiki/Zimbra_Releases/10.1.5#Security_Fixes(Release Notes)
- https://wiki.zimbra.com/wiki/Zimbra_Releases/9.0.0/P44#Security_Fixes(Release Notes)
- https://strikeready.com/blog/0day-ics-attack-in-the-wild/(Exploit, Third Party Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-27915(US Government Resource)
Weakness Type
CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CWE-79 describes a vulnerability where software does not properly neutralize user-controllable input before it is placed in output used as a web page served to other users. In CVE-2025-27915, the Zimbra Classic Web Client fails to adequately sanitize HTML content embedded within ICS calendar file attachments in emails. The specific bypass uses a <details> tag with an ontoggle event handler, which is not caught by Zimbra's HTML sanitization filters. This allows an attacker to inject and execute arbitrary JavaScript in the context of a victim's authenticated Zimbra session when they view the malicious email. Cross-site scripting in email clients is particularly dangerous because emails are a primary attack vector and users routinely view untrusted content.
Impact Analysis
The business impact of CVE-2025-27915 is significant despite its medium CVSS score, primarily because of its exploitation context within an email platform. Confidentiality is partially compromised because the attacker's JavaScript executes within the victim's authenticated Zimbra session, enabling access to email content, contacts, calendar entries, and session tokens. The attacker can silently read and exfiltrate sensitive email communications without the victim's knowledge. Integrity is similarly affected since the attacker can use the victim's session to send emails, modify calendar entries, change account settings, or create mail forwarding rules that persist beyond the initial compromise.
The Changed scope (S:C) in the CVSS vector is particularly noteworthy—it indicates that the vulnerability in the web client component can impact resources beyond its own security authority, such as the victim's broader Zimbra account and any systems accessible through information harvested from the mailbox. The EPSS score of 27.69% (96.3rd percentile) indicates this vulnerability is more likely to be exploited than approximately 96% of all known CVEs. CISA's KEV listing confirms active exploitation in the wild, and a 0-day exploit report from StrikeReady documents that this vulnerability was discovered being exploited before a patch was available. While the ransomware association is listed as "Unknown," stored XSS in email platforms is frequently used for credential theft, account takeover, and as an initial access vector in targeted campaigns against organizations.
Exploit Maturity
CVE-2025-27915 was discovered as a 0-day vulnerability being actively exploited in the wild before Zimbra released patches. The StrikeReady research team documented the in-the-wild exploitation, detailing how attackers used malicious ICS file attachments to deliver stored XSS payloads through the Zimbra Classic Web Client. CISA has confirmed the active exploitation by adding this vulnerability to the Known Exploited Vulnerabilities (KEV) catalog with a remediation due date of October 28, 2025.
The EPSS score of 27.69% (96.3rd percentile) is very high for an XSS vulnerability, reflecting the broad deployment of Zimbra, the ease of exploitation through email delivery, and the demonstrated real-world attacker interest. The exploit mechanism is straightforward: an attacker crafts an email with a malicious ICS attachment containing a <details> tag with an ontoggle JavaScript event handler, which bypasses Zimbra's HTML sanitization. When the victim views the email in the Classic Web Client, the JavaScript executes automatically. The ransomware association is listed as "Unknown," but Zimbra has historically been a high-priority target for advanced persistent threat (APT) groups and espionage campaigns, making this vulnerability particularly concerning for government, defense, and enterprise organizations using Zimbra.
Remediation
-
Update Zimbra Collaboration Suite to a patched version immediately. Apply the security fixes by upgrading to ZCS 10.0.13, ZCS 10.1.5, or ZCS 9.0.0 Patch 44 depending on your current version. Refer to the official Zimbra release notes for 10.0.13, 10.1.5, and 9.0.0 P44 for full details and installation instructions.
-
Disable the Classic Web Client if possible. The vulnerability specifically affects the Zimbra Classic Web Client interface. If your organization can transition users to the Modern Web Client or other email clients (IMAP/POP3 with desktop applications), disabling the Classic Web Client eliminates this specific attack vector while awaiting or in addition to patching.
-
Inspect mailboxes for malicious ICS attachments. Search email stores for ICS file attachments containing suspicious HTML elements, particularly
<details>tags withontoggleor other event handler attributes. Quarantine or remove any identified malicious messages to prevent further exploitation by users who may not have upgraded their client interface. -
Review account activity for indicators of compromise. Check for signs of exploitation including unauthorized email forwarding rules, unexpected sent messages, modified account settings, new application passwords or OAuth tokens, and suspicious login activity. Pay particular attention to accounts of high-value targets such as executives and administrators.
-
Implement Content Security Policy (CSP) headers. Configure your Zimbra web server or reverse proxy to serve strict Content Security Policy headers that restrict inline JavaScript execution. While CSP alone may not prevent all XSS variants, it provides an additional layer of defense against script injection attacks in the web client.
Technical Details
The CVSS v3.1 vector for CVE-2025-27915 is CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N, resulting in a base score of 5.4 (Medium). Attack Vector (AV:N) indicates the attack is delivered over the network, specifically via email. Attack Complexity (AC:L) means the exploit is straightforward with no special conditions required. Privileges Required (PR:L) indicates the attacker needs a low-privileged account—specifically, the ability to send an email to the target, which effectively means any email sender including external parties. User Interaction (UI:R) is required because the victim must view the malicious email in the Classic Web Client for the payload to execute. Scope (S:C) is Changed, meaning the vulnerable component (the email rendering engine) enables impact on a different security authority (the user's authenticated session and account). Confidentiality (C:L) and Integrity (I:L) are both rated Low, reflecting the partial nature of XSS-based data access and modification. Availability (A:N) is not impacted.
The technical attack mechanism targets Zimbra's ICS (iCalendar) file rendering in the Classic Web Client. When a user receives an email with an ICS calendar attachment, the Classic Web Client parses and renders the ICS content to display calendar event details inline. The vulnerability exists because Zimbra's HTML sanitization does not properly handle the <details> HTML element and its ontoggle event attribute. An attacker embeds a <details> tag within the ICS file content, with an ontoggle attribute containing malicious JavaScript. When the Classic Web Client renders this content, the <details> element is inserted into the DOM. The ontoggle event fires when the element's open state changes, which can be triggered automatically through CSS or DOM manipulation, causing the embedded JavaScript to execute within the victim's authenticated session context. This is a stored XSS variant because the malicious payload persists in the email message and executes each time a user views the email.
Frequently Asked Questions
What is CVE-2025-27915?
CVE-2025-27915 is a stored cross-site scripting (XSS) vulnerability in Zimbra Collaboration Suite (ZCS) versions 9.0, 10.0, and 10.1. It allows an attacker to inject malicious JavaScript through crafted ICS calendar file attachments in emails, which executes when a victim views the email in the Zimbra Classic Web Client.
Was CVE-2025-27915 exploited as a 0-day?
Yes. Security researchers at StrikeReady documented active exploitation of this vulnerability before Zimbra released patches, classifying it as a 0-day attack. CISA subsequently added it to the Known Exploited Vulnerabilities catalog. The EPSS score of 27.69% (96.3rd percentile) confirms extremely high exploitation activity.
Does this vulnerability affect the Zimbra Modern Web Client?
The vulnerability specifically affects the Zimbra Classic Web Client. The Modern Web Client uses different rendering and sanitization code paths. However, organizations should still apply the patches as a defense-in-depth measure, and transitioning users from the Classic to the Modern Web Client reduces exposure to this specific attack vector.
What can an attacker do by exploiting this vulnerability?
Through the stored XSS payload, an attacker can execute arbitrary JavaScript within the victim's authenticated Zimbra session. This enables reading email content, stealing session tokens, sending emails as the victim, creating persistent mail forwarding rules, and modifying account settings. The attack is triggered simply by viewing the malicious email, requiring no additional user action beyond opening the message.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.