{"id":"CVE-2022-27925","published":"2022-04-21T00:15:08Z","modified":"2026-10-01T19:17:14Z","title":"Synacor Zimbra Collaboration Suite (ZCS) Arbitrary File Upload Vulnerability","vendor":"Synacor","product":"Zimbra Collaboration Suite (ZCS)","tier":"core","eol":null,"description":{"text":"Zimbra Collaboration (aka ZCS) 8.8.15 and 9.0 has mboximport functionality that receives a ZIP archive and extracts files from it. An authenticated user with administrator rights has the ability to upload arbitrary files to the system, leading to directory traversal.","provenance":"source","from":"NVD"},"summary":{"text":"The flaw is an arbitrary file upload and directory traversal issue in the mboximport functionality of Synacor's Zimbra Collaboration Suite (ZCS), which extracts files from uploaded ZIP archives. An attacker who is an authenticated user holding administrator rights over the network, with no user interaction required, can upload arbitrary files to the system through this function.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-29T08:31:24Z"},"cvss":{"score":7.2,"severity":"HIGH","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","provenance":"source","from":"NVD"},"epss":{"score":0.98676,"percentile":0.99924,"date":"2026-10-29","provenance":"source"},"kev":{"dateAdded":"2022-08-11","dueDate":"2022-09-01","ransomware":true,"requiredAction":"Apply updates per vendor instructions.","notes":"https://blog.zimbra.com/2022/08/authentication-bypass-in-mailboximportservlet-vulnerability/;  https://nvd.nist.gov/vuln/detail/CVE-2022-27925","provenance":"source"},"vulncheckKev":{"dateAdded":"2022-08-11","exploitedFirstSeen":"2022-08-11","ransomware":true,"evidence":[{"url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","date":"2022-08-11"},{"url":"https://web.archive.org/web/20230318134256/https://unit42.paloaltonetworks.com/network-security-trends-aug-oct-2022/","date":"2023-01-12"},{"url":"https://assets.sentinelone.com/wt-reports/watchtower_2022_eoy","date":"2023-01-18"},{"url":"https://www.cert.ssi.gouv.fr/uploads/CERTFR-2023-CTI-001.pdf","date":"2023-01-24"},{"url":"https://cisa.gov/news-events/cybersecurity-advisories/aa22-228a","date":"2023-01-27"},{"url":"https://labs.withsecure.com/content/dam/labs/docs/WithSecure-Lazarus-No-Pineapple-Threat-Intelligence-Report-2023.pdf","date":"2023-02-02"},{"url":"https://socradar.io/threat-actor-profile-bianlian-the-shape-shifting-ransomware-group/","date":"2023-07-13"},{"url":"https://cisa.gov/news-events/cybersecurity-advisories/aa23-278a","date":"2023-10-05"},{"url":"https://cyberint.com/blog/research/ransomware-trends-q3-2023-report/","date":"2023-10-21"},{"url":"https://cyberint.com/blog/research/ransomware-trends-and-statistics-2023-report/","date":"2024-04-24"}],"evidenceTotal":21,"provenance":"source"},"exploited":true,"otx":{"pulseCount":50,"pulses":[{"name":"Actively_Exploited_Kev | Oct 29, 2026","url":"https://otx.alienvault.com/pulse/6ae20c1db17e7057ae7d9ad1","created":"2026-10-28"},{"name":"Actively_Exploited_Kev | Oct 28, 2026","url":"https://otx.alienvault.com/pulse/6ae0ba7e0e2a97ff7b218819","created":"2026-10-27"},{"name":"Actively_Exploited_Kev | Oct 27, 2026","url":"https://otx.alienvault.com/pulse/6adf68b85c3e852f3c111d18","created":"2026-10-26"},{"name":"Actively_Exploited_Kev | Oct 24, 2026","url":"https://otx.alienvault.com/pulse/6adb740e397c3ad4799aa4cd","created":"2026-10-23"},{"name":"Actively_Exploited_Kev | Oct 23, 2026","url":"https://otx.alienvault.com/pulse/6ada236fcfba2dfa730ea482","created":"2026-10-22"},{"name":"Actively_Exploited_Kev | Oct 22, 2026","url":"https://otx.alienvault.com/pulse/6ad8d33a077cbb5cab524d80","created":"2026-10-21"},{"name":"Actively_Exploited_Kev | Oct 21, 2026","url":"https://otx.alienvault.com/pulse/6ad78130c4d1ac2be83a8b6d","created":"2026-10-20"},{"name":"Actively_Exploited_Kev | Oct 20, 2026","url":"https://otx.alienvault.com/pulse/6ad62f63c24a405a3423cc13","created":"2026-10-19"},{"name":"Actively_Exploited_Kev | Oct 19, 2026","url":"https://otx.alienvault.com/pulse/6ad4dda174e5797d0bd238b7","created":"2026-10-18"},{"name":"Actively_Exploited_Kev | Oct 18, 2026","url":"https://otx.alienvault.com/pulse/6ad38c22e1848f8189d1c121","created":"2026-10-17"}],"provenance":"machine"},"cwes":[{"id":"CWE-22","name":"Improper Limitation of a Pathname to a Restricted Directory"}],"references":[{"url":"http://packetstormsecurity.com/files/168146/Zimbra-Zip-Path-Traversal.html","tags":["Exploit","Third Party Advisory","VDB Entry"]},{"url":"https://wiki.zimbra.com/wiki/Security_Center","tags":["Vendor Advisory"]},{"url":"https://wiki.zimbra.com/wiki/Zimbra_Releases/9.0.0/P24","tags":["Release Notes","Vendor Advisory"]},{"url":"https://wiki.zimbra.com/wiki/Zimbra_Security_Advisories","tags":["Vendor Advisory"]},{"url":"http://packetstormsecurity.com/files/168146/Zimbra-Zip-Path-Traversal.html","tags":["Exploit","Third Party Advisory","VDB Entry"]},{"url":"https://wiki.zimbra.com/wiki/Security_Center","tags":["Vendor Advisory"]},{"url":"https://wiki.zimbra.com/wiki/Zimbra_Releases/9.0.0/P24","tags":["Release Notes","Vendor Advisory"]},{"url":"https://wiki.zimbra.com/wiki/Zimbra_Security_Advisories","tags":["Vendor Advisory"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2022-27925","tags":["US Government Resource"]}],"techniques":[{"id":"T1190","name":"Exploit Public-Facing Application","tactics":["initial-access"],"provenance":"ai","basis":"ai-mapping","bases":["ai-mapping"],"basisDetail":"claude-haiku-5-5: Exploited via public-facing mail app upload functionality","mappingType":"exploitation_technique","evidence":[{"from":"description","quote":"An authenticated user with administrator rights has the ability to upload arbitrary files","start":131,"end":220}],"model":"claude-haiku-5-5","confidence":"medium","confidenceNote":"AI-mapped from the description (quote-validated, not expert-reviewed)"},{"id":"T1005","name":"Data from Local System","tactics":["collection"],"provenance":"ai","basis":"ai-mapping","bases":["ai-mapping"],"basisDetail":"claude-haiku-5-5: Traversal allows reading arbitrary local files","mappingType":"primary_impact","evidence":[{"from":"description","quote":"leading to directory traversal","start":236,"end":266}],"model":"claude-haiku-5-5","confidence":"medium","confidenceNote":"AI-mapped from the description (quote-validated, not expert-reviewed)"}],"reports":[],"affected":[],"advisories":[],"euvd":{"id":"EUVD-2022-32413","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2022-32413","exploited":true,"exploitedSince":"2022-08-11","provenance":"source"},"exploits":[],"exploitSources":{"pocGithub":{"count":8,"skipped":4,"earliest":"2022-08-12","earliestUrl":"https://github.com/vnhacker1337/CVE-2022-27925-PoC","repos":[{"name":"vnhacker1337/CVE-2022-27925-PoC","url":"https://github.com/vnhacker1337/CVE-2022-27925-PoC","stars":65,"created":"2022-08-12"},{"name":"Josexv1/CVE-2022-27925","url":"https://github.com/Josexv1/CVE-2022-27925","stars":43,"created":"2022-08-20"},{"name":"sh4den/CVE-2022-27925","url":"https://github.com/sh4den/CVE-2022-27925","stars":18,"created":"2022-10-01"},{"name":"jam620/Zimbra","url":"https://github.com/jam620/Zimbra","stars":8,"created":"2022-09-25"},{"name":"Chocapikk/CVE-2022-27925-Revshell","url":"https://github.com/Chocapikk/CVE-2022-27925-Revshell","stars":5,"created":"2022-08-26"}]},"metasploit":[{"name":"Zip Path Traversal in Zimbra (mboximport) (CVE-2022-27925)","module":"exploit/linux/http/zimbra_mboximport_cve_2022_27925","type":"exploit","disclosureDate":"2022-05-10","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/http/zimbra_mboximport_cve_2022_27925.rb"}],"nuclei":[{"id":"CVE-2022-27925","name":"Zimbra Collaboration Suite 8.8.15/9.0 - Zip Path Traversal","severity":"high","path":"http/cves/2022/CVE-2022-27925.yaml","url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-27925.yaml"}],"first":{"date":"2022-05-10","source":"Metasploit","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/http/zimbra_mboximport_cve_2022_27925.rb"},"provenance":"source"},"detections":{"cveRules":[{"title":"Zimbra Collaboration Suite Email Server Unauthenticated RCE","id":"dd218fb6-4d02-42dc-85f0-a0a376072efd","level":"medium","status":"test","path":"rules-emerging-threats/2022/Exploits/CVE-2022-27925/web_cve_2022_27925_exploit.yml","url":"https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2022/Exploits/CVE-2022-27925/web_cve_2022_27925_exploit.yml","techniques":["T1190"]}]},"exploitRefs":["http://packetstormsecurity.com/files/168146/Zimbra-Zip-Path-Traversal.html"],"flow":[{"stage":"exploitation","techniques":["T1190"],"provenance":"ai"},{"stage":"primary","techniques":["T1005"],"provenance":"ai"}],"timeline":[{"date":"2022-04-21","kind":"published","label":"Published (NVD)","url":"https://nvd.nist.gov/vuln/detail/CVE-2022-27925","provenance":"source"},{"date":"2022-05-10","kind":"exploit-public","label":"First public exploit: Metasploit; later: PoC-in-GitHub 2022-08-12","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/http/zimbra_mboximport_cve_2022_27925.rb","provenance":"source"},{"date":"2022-08-11","kind":"exploited-reported","label":"Exploitation first reported (VulnCheck KEV evidence)","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","provenance":"source"},{"date":"2022-08-11","kind":"kev","label":"Added to CISA KEV (known ransomware use)","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","provenance":"source"},{"date":"2022-08-11","kind":"euvd-exploited","label":"ENISA EUVD: exploited","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2022-32413","provenance":"source"}],"speed":{"daysToPublicExploit":19,"firstExploitFrom":"Metasploit","daysToKev":112},"priority":{"score":78.0,"factors":[{"name":"In a KEV catalog","points":35.0,"detail":"listed in CISA KEV and VulnCheck KEV"},{"name":"Recent KEV listing","points":0.0,"detail":"added 1540 days ago"},{"name":"Known ransomware use","points":10.0,"detail":"CISA KEV and VulnCheck KEV: Known"},{"name":"EPSS percentile","points":19.98,"detail":"percentile 0.9992"},{"name":"Named in threat reports","points":0.0,"detail":"0 reports"},{"name":"Public exploit code","points":5.0,"detail":"1 NVD reference tagged Exploit; 8 PoC-in-GitHub repos; 1 Metasploit module; 1 nuclei template"},{"name":"Mentioned in OTX pulses","points":3.0,"detail":"50 pulses"},{"name":"CVSS severity","points":5.04,"detail":"base score 7.2"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]},"lineage":{"familyId":"fam-synacor-zimbra-collaboration-suite-zcs-cve-2022-27925","children":[{"from":"CVE-2022-27925","to":"CVE-2022-37042","relation":"incomplete-fix","confidence":"high","kind":"lineage","evidence":[{"kind":"text","provenance":"source","relation":"incomplete-fix","quote":"NOTE: this issue exists because of an incomplete fix for CVE-2022-27925.","from":"NVD","in":"CVE-2022-37042"},{"kind":"similar","provenance":"machine","score":0.72,"basis":"same product + CWE + description similarity"}]}]}}