CVE-2022-27925

High · CVSS 7.2EPSS 98.2%CISA KEVCWE-22 · Path Traversal

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Zimbra Collaboration (aka ZCS) 8.8.15 and 9.0 has mboximport functionality that receives a ZIP archive and extracts files from it. An authenticated user with administrator rights has the ability to upload arbitrary files to the system, leading to directory traversal.

References

NVD MITRE CVE.org CISA KEV

Published Apr 21, 2022

Community ground truth

Community verdict

2 verdicts

Not a real issue

to add your verdict.

Community real-world severity: Critical (Critical 2) — CVSS base score 7.2

Practitioners rate this higher than its CVSS — treat with extra caution.

Field notes & remediation

Verdicts are the quick signal — notes are the evidence and fixes behind them.

No notes yet — be the first to share what you saw or a fix that worked.