CVE-2025-68645
Synacor Zimbra Collaboration Suite (ZCS) PHP Remote File Inclusion Vulnerability
Description
CVE-2025-68645 is a high-severity Local File Inclusion (LFI) vulnerability in the Webmail Classic UI of Zimbra Collaboration Suite (ZCS) versions 10.0 and 10.1. The vulnerability exists due to improper handling of user-supplied request parameters in the RestFilter servlet, allowing an unauthenticated remote attacker to craft requests to the /h/rest endpoint that influence internal request dispatching and include arbitrary files from the WebRoot directory. With a CVSS v3.1 base score of 8.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H), successful exploitation can lead to complete server compromise. The vulnerability is listed in CISA's KEV catalog with a remediation deadline of February 12, 2026, and has an EPSS score of 0.22921 (95.8th percentile).
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:HOpen in CalculatorCWEs
Affected Products
| Vendor | Product | Version |
|---|---|---|
| synacor | zimbra collaboration suite | >= 10.0.0, < 10.0.18; >= 10.1.0, < 10.1.13 |
References
- https://wiki.zimbra.com/wiki/Security_Center(Release Notes, Vendor Advisory)
- https://wiki.zimbra.com/wiki/Zimbra_Responsible_Disclosure_Policy(Product)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-68645(US Government Resource)
Weakness Type
CWE-98: Improper Control of Filename for Include/Require Statement in PHP Program
CVE-2025-68645 is classified under CWE-98, which describes software that allows user-supplied input to be used in file include operations without proper validation or sanitization. In the context of Zimbra Collaboration Suite, the RestFilter servlet processes user-supplied parameters from requests to the /h/rest endpoint. These parameters influence how the servlet dispatches internal requests and determines which files to include in the response. By crafting malicious parameter values, an attacker can manipulate the inclusion mechanism to load arbitrary files from the WebRoot directory, potentially exposing configuration files, credentials, and other sensitive data, or achieving code execution if executable files can be included. Learn more about CWE-98
Impact Analysis
Arbitrary File Inclusion Leading to Server Compromise is the primary impact of CVE-2025-68645. The ability to include arbitrary files from the WebRoot directory can expose sensitive configuration data, application source code, and potentially enable code execution if the attacker can include files containing executable content.
Confidentiality Impact is high (C:H). Through the LFI vulnerability, an attacker can read sensitive files from the Zimbra WebRoot directory, including configuration files that may contain database credentials, LDAP bind passwords, API keys, and other secrets. Zimbra stores significant configuration data within its web application directories that, if exposed, provides the attacker with credentials to access the mail database, directory service, and other backend systems.
Integrity Impact is high (I:H). If the attacker can leverage the file inclusion to execute code (for example, by including an uploaded file or a file with controllable content), they gain the ability to modify email data, alter server configurations, inject malicious content into webmail sessions, and install persistent backdoors. Even without direct code execution, exposed credentials enable the attacker to authenticate to backend services and make unauthorized modifications.
Availability Impact is high (A:H). An attacker who achieves code execution or obtains administrative credentials through the LFI can shut down the Zimbra services, delete email data, or otherwise render the collaboration platform unavailable.
Zimbra as a Target: Zimbra Collaboration Suite is a widely deployed enterprise email and collaboration platform. Compromising a Zimbra server exposes all hosted email accounts, calendar data, contacts, and shared files. The EPSS score of 0.22921 (95.8th percentile) indicates significant exploitation activity. CISA lists the ransomware association as "Unknown."
Exploit Maturity
CVE-2025-68645 is confirmed as actively exploited, as reflected by its inclusion in CISA's KEV catalog with a remediation deadline of February 12, 2026. The EPSS score of 0.22921 (95.8th percentile) confirms elevated exploitation probability.
Exploitation Context: The vulnerability is exploitable by an unauthenticated remote attacker, though user interaction is required (UI:R in the CVSS vector), suggesting that the attack may require the victim to click a crafted link or visit a malicious page that triggers the request to the Zimbra server. This is consistent with how LFI vulnerabilities in webmail interfaces are typically exploited through phishing or cross-site attacks.
Zimbra Vulnerability History: Zimbra Collaboration Suite has a significant history of critical vulnerabilities being actively exploited, including CVE-2022-27924, CVE-2022-37042, and CVE-2023-37580. Threat actors have consistently targeted Zimbra servers for email espionage, credential theft, and as pivot points for further network compromise. The pattern of Zimbra exploitation makes any new vulnerability in the platform a high-priority concern.
Vendor Advisory: Zimbra has published information about this vulnerability through their Security Center. Fixed versions are available for both the 10.0 and 10.1 branches.
Ransomware Association: CISA lists the ransomware association as "Unknown." However, given the history of email server compromises leading to broader network intrusions and the high value of email data, Zimbra vulnerabilities represent viable initial access vectors for ransomware operators.
Remediation
-
Upgrade Zimbra Collaboration Suite to the fixed version immediately. For ZCS 10.0, update to version 10.0.18 or later. For ZCS 10.1, update to version 10.1.13 or later. These versions address the improper parameter handling in the RestFilter servlet. Consult the Zimbra Security Center for detailed update instructions and release notes.
-
Restrict access to the Classic UI webmail interface as an immediate mitigation if patching is delayed. If your organization has migrated users to the Modern UI, consider disabling the Classic UI entirely or restricting access to it through reverse proxy configuration. The vulnerability specifically affects the /h/rest endpoint in the Classic UI.
-
Implement web application firewall (WAF) rules to detect and block exploitation attempts targeting the /h/rest endpoint. Configure the WAF to inspect request parameters for path traversal patterns, unusual file references, and other indicators of LFI attacks. This provides a defense-in-depth layer while the patch is being deployed.
-
Audit Zimbra server logs for indicators of compromise before and after patching. Review web access logs for unusual requests to the /h/rest endpoint, particularly those with manipulated parameters or path traversal sequences. Check for unauthorized file access, unexpected process execution, and signs of credential theft or email exfiltration.
-
Harden the Zimbra deployment by implementing network segmentation, restricting administrative access to trusted networks, enabling comprehensive audit logging, and configuring intrusion detection systems to monitor for Zimbra-specific attack patterns. Ensure that the Zimbra service runs with minimal required operating system privileges to limit the impact of any successful exploitation.
Technical Details
CVE-2025-68645 is a Local File Inclusion (LFI) vulnerability in the Webmail Classic UI of Zimbra Collaboration Suite (ZCS) versions 10.0 (prior to 10.0.18) and 10.1 (prior to 10.1.13). The vulnerability resides in the RestFilter servlet's handling of user-supplied request parameters.
CVSS Vector Breakdown: The vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H yields a score of 8.8. The attack is network-based (AV:N) with low complexity (AC:L) and requires no authentication (PR:N). User interaction is required (UI:R), meaning the victim must perform some action such as clicking a crafted link. The scope is unchanged (S:U), and all impact dimensions are high (C:H/I:H/A:H).
Vulnerability Mechanism: The Zimbra Classic UI exposes the /h/rest endpoint through the RestFilter servlet, which processes various user-supplied request parameters to determine how to handle and dispatch incoming requests. The servlet uses these parameters to construct internal file paths or dispatch targets. The vulnerability occurs because the servlet fails to properly validate and sanitize these parameter values before using them in file inclusion operations. An attacker can craft parameter values that manipulate the internal request dispatching mechanism, causing the servlet to include files from arbitrary locations within the Zimbra WebRoot directory.
File Inclusion Scope: The inclusion is limited to files within the WebRoot directory structure, which restricts direct access to operating system files outside the web application. However, the WebRoot directory contains significant sensitive content including configuration files, JSP sources, property files with credentials, and potentially user-uploaded content. Access to these files can provide the attacker with sufficient information and credentials to escalate to full server compromise.
Attack Vector: The UI:R requirement in the CVSS vector indicates that user interaction is needed. This typically means the attacker must craft a URL that includes the malicious parameters and convince a user to visit it (through phishing or cross-site request). When the victim's browser sends the crafted request to the Zimbra server, the RestFilter processes the malicious parameters and returns the included file content.
Affected Versions: The vulnerability affects ZCS 10.0 (prior to 10.0.18) and ZCS 10.1 (prior to 10.1.13). Earlier major versions of Zimbra may use a different implementation of the RestFilter and are not confirmed as affected by this specific vulnerability.
Frequently Asked Questions
What is CVE-2025-68645?
CVE-2025-68645 is a Local File Inclusion vulnerability in the Classic Webmail UI of Zimbra Collaboration Suite (ZCS) versions 10.0 and 10.1. It allows an unauthenticated attacker to include arbitrary files from the server's WebRoot directory by manipulating request parameters sent to the /h/rest endpoint, potentially leading to full server compromise.
Does the attacker need credentials to exploit this vulnerability?
No, the attacker does not need any Zimbra credentials (PR:N). However, user interaction is required (UI:R), meaning the attack typically requires a victim to click a crafted link or visit a page that triggers the malicious request to the Zimbra server. This makes phishing the most likely delivery mechanism.
Is only the Classic UI affected?
Yes, CVE-2025-68645 specifically affects the Classic Webmail UI and its RestFilter servlet. The Modern UI uses a different architecture and request handling mechanism. However, many Zimbra deployments still have the Classic UI enabled alongside or instead of the Modern UI. Even if users primarily use the Modern UI, the Classic UI endpoints may still be accessible and exploitable.
Which Zimbra versions should I upgrade to?
For ZCS 10.0, upgrade to version 10.0.18 or later. For ZCS 10.1, upgrade to version 10.1.13 or later. Check the Zimbra Security Center for the specific patch or update package for your deployment.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.