{"id":"CVE-2022-41352","published":"2022-09-26T02:15:10Z","modified":"2026-09-10T04:17:37Z","title":"Synacor Zimbra Collaboration Suite (ZCS) Arbitrary File Upload Vulnerability","vendor":"Synacor","product":"Zimbra Collaboration Suite (ZCS)","tier":"core","eol":null,"description":{"text":"An issue was discovered in Zimbra Collaboration (ZCS) 8.8.15 and 9.0. An attacker can upload arbitrary files through amavis via a cpio loophole (extraction to /opt/zimbra/jetty/webapps/zimbra/public) that can lead to incorrect access to any other user accounts. Zimbra recommends pax over cpio. Also, pax is in the prerequisites of Zimbra on Ubuntu; however, pax is no longer part of a default Red Hat installation after RHEL 6 (or CentOS 6). Once pax is installed, amavis automatically prefers it over cpio.","provenance":"source","from":"NVD"},"summary":{"text":"Zimbra Collaboration Suite (ZCS) versions 8.8.15 and 9.0 contain an arbitrary file upload flaw in the amavis component, where extraction via the cpio utility can write files into the /opt/zimbra/jetty/webapps/zimbra/public directory. An attacker who can send mail through this path can place arbitrary files there, which can lead to unauthorised access to other user accounts, with no authentication or user interaction required.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-29T07:53:42Z"},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","provenance":"source","from":"NVD"},"epss":{"score":0.95478,"percentile":0.99869,"date":"2026-10-29","provenance":"source"},"kev":{"dateAdded":"2022-10-20","dueDate":"2022-11-10","ransomware":true,"requiredAction":"Apply updates per vendor instructions.","notes":"https://wiki.zimbra.com/wiki/Security_Center;  https://nvd.nist.gov/vuln/detail/CVE-2022-41352","provenance":"source"},"vulncheckKev":{"dateAdded":"2022-10-20","exploitedFirstSeen":"2022-10-20","ransomware":true,"evidence":[{"url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","date":"2022-10-20"},{"url":"https://www.group-ib.com/blog/bablock-ransomware/","date":"2023-04-04"},{"url":"https://sosintel.co.uk/flash-alert-cves-of-note-being-exploited-in-the-wild/","date":"2023-07-26"},{"url":"https://go.recordedfuture.com/hubfs/reports/cta-2024-0208.pdf","date":"2024-02-08"},{"url":"https://rt-solar.ru/solar-4rays/blog/4333/","date":"2024-05-24"},{"url":"https://cloud.google.com/blog/topics/threat-intelligence/cyber-threats-targeting-brazil","date":"2024-06-12"},{"url":"https://rt-solar.ru/solar-4rays/blog/4527/","date":"2024-07-18"},{"url":"https://www.cisa.gov/sites/default/files/2024-07/aa24-207a-dprk-cyber-group-conducts-global-espionage-campaign.pdf","date":"2024-07-25"},{"url":"https://www.microsoft.com/en-us/security/blog/2025/02/12/the-badpilot-campaign-seashell-blizzard-subgroup-conducts-multiyear-global-access-operation/","date":"2025-02-12"},{"url":"https://go.intel471.com/hubfs/Emerging%20Threats/Emerging%20Threats%20-%20BadPilot%20Campaign.pdf","date":"2025-02-20"}],"evidenceTotal":12,"provenance":"source"},"exploited":true,"otx":{"pulseCount":50,"pulses":[{"name":"Actively_Exploited_Kev | Oct 29, 2026","url":"https://otx.alienvault.com/pulse/6ae20c1db17e7057ae7d9ad1","created":"2026-10-28"},{"name":"Actively_Exploited_Kev | Oct 28, 2026","url":"https://otx.alienvault.com/pulse/6ae0ba7e0e2a97ff7b218819","created":"2026-10-27"},{"name":"Actively_Exploited_Kev | Oct 27, 2026","url":"https://otx.alienvault.com/pulse/6adf68b85c3e852f3c111d18","created":"2026-10-26"},{"name":"Actively_Exploited_Kev | Oct 24, 2026","url":"https://otx.alienvault.com/pulse/6adb740e397c3ad4799aa4cd","created":"2026-10-23"},{"name":"Actively_Exploited_Kev | Oct 23, 2026","url":"https://otx.alienvault.com/pulse/6ada236fcfba2dfa730ea482","created":"2026-10-22"},{"name":"Actively_Exploited_Kev | Oct 22, 2026","url":"https://otx.alienvault.com/pulse/6ad8d33a077cbb5cab524d80","created":"2026-10-21"},{"name":"Actively_Exploited_Kev | Oct 21, 2026","url":"https://otx.alienvault.com/pulse/6ad78130c4d1ac2be83a8b6d","created":"2026-10-20"},{"name":"Actively_Exploited_Kev | Oct 20, 2026","url":"https://otx.alienvault.com/pulse/6ad62f63c24a405a3423cc13","created":"2026-10-19"},{"name":"Actively_Exploited_Kev | Oct 19, 2026","url":"https://otx.alienvault.com/pulse/6ad4dda174e5797d0bd238b7","created":"2026-10-18"},{"name":"Actively_Exploited_Kev | Oct 18, 2026","url":"https://otx.alienvault.com/pulse/6ad38c22e1848f8189d1c121","created":"2026-10-17"}],"provenance":"machine"},"cwes":[{"id":"CWE-22","name":"Improper Limitation of a Pathname to a Restricted Directory"}],"references":[{"url":"http://packetstormsecurity.com/files/169458/Zimbra-Collaboration-Suite-TAR-Path-Traversal.html","tags":["Exploit","Third Party Advisory","VDB Entry"]},{"url":"https://forums.zimbra.org/viewtopic.php?t=71153&p=306532","tags":["Mitigation","Vendor Advisory"]},{"url":"https://wiki.zimbra.com/wiki/Security_Center","tags":["Patch","Release Notes","Vendor Advisory"]},{"url":"https://wiki.zimbra.com/wiki/Zimbra_Security_Advisories","tags":["Vendor Advisory"]},{"url":"https://www.secpod.com/blog/unpatched-rce-bug-in-zimbra-collaboration-suite-exploited-in-wild/","tags":["Third Party Advisory"]},{"url":"http://packetstormsecurity.com/files/169458/Zimbra-Collaboration-Suite-TAR-Path-Traversal.html","tags":["Exploit","Third Party Advisory","VDB Entry"]},{"url":"https://forums.zimbra.org/viewtopic.php?t=71153&p=306532","tags":["Mitigation","Vendor Advisory"]},{"url":"https://wiki.zimbra.com/wiki/Security_Center","tags":["Patch","Release Notes","Vendor Advisory"]},{"url":"https://wiki.zimbra.com/wiki/Zimbra_Security_Advisories","tags":["Vendor Advisory"]},{"url":"https://www.secpod.com/blog/unpatched-rce-bug-in-zimbra-collaboration-suite-exploited-in-wild/","tags":["Third Party Advisory"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2022-41352","tags":["US Government Resource"]}],"techniques":[{"id":"T1190","name":"Exploit Public-Facing Application","tactics":["initial-access"],"provenance":"ai","basis":"ai-mapping","bases":["ai-mapping"],"basisDetail":"claude-haiku-5-5: Unauthenticated file upload to public-facing mail server","mappingType":"exploitation_technique","evidence":[{"from":"description","quote":"An attacker can upload arbitrary files through amavis via a cpio loophole","start":70,"end":143}],"model":"claude-haiku-5-5","confidence":"medium","confidenceNote":"AI-mapped from the description (quote-validated, not expert-reviewed)"},{"id":"T1505.003","name":"Web Shell","tactics":["persistence"],"provenance":"ai","basis":"ai-mapping","bases":["ai-mapping"],"basisDetail":"claude-haiku-5-5: Writes web shell into public webapp directory","mappingType":"primary_impact","evidence":[{"from":"description","quote":"extraction to /opt/zimbra/jetty/webapps/zimbra/public","start":145,"end":198}],"model":"claude-haiku-5-5","confidence":"medium","confidenceNote":"AI-mapped from the description (quote-validated, not expert-reviewed)"}],"reports":[],"affected":[],"advisories":[],"euvd":{"id":"EUVD-2022-44557","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2022-44557","exploited":true,"exploitedSince":"2022-10-20","provenance":"source"},"exploits":[],"exploitSources":{"pocGithub":{"count":2,"skipped":1,"earliest":"2022-10-10","earliestUrl":"https://github.com/segfault-it/cve-2022-41352","repos":[{"name":"Cr4ckC4t/cve-2022-41352-zimbra-rce","url":"https://github.com/Cr4ckC4t/cve-2022-41352-zimbra-rce","stars":109,"created":"2022-11-11"},{"name":"segfault-it/cve-2022-41352","url":"https://github.com/segfault-it/cve-2022-41352","stars":8,"created":"2022-10-10"}]},"metasploit":[{"name":"TAR Path Traversal in Zimbra (CVE-2022-41352)","module":"exploit/linux/http/zimbra_cpio_cve_2022_41352","type":"exploit","disclosureDate":"2022-06-28","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/http/zimbra_cpio_cve_2022_41352.rb"}],"nuclei":[{"id":"CVE-2022-41352","name":"Zimbra Collaboration - Unrestricted File Upload","severity":"critical","path":"http/cves/2022/CVE-2022-41352.yaml","url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-41352.yaml"}],"first":{"date":"2022-06-28","source":"Metasploit","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/http/zimbra_cpio_cve_2022_41352.rb"},"provenance":"source"},"exploitRefs":["http://packetstormsecurity.com/files/169458/Zimbra-Collaboration-Suite-TAR-Path-Traversal.html"],"flow":[{"stage":"exploitation","techniques":["T1190"],"provenance":"ai"},{"stage":"primary","techniques":["T1505.003"],"provenance":"ai"}],"timeline":[{"date":"2022-06-28","kind":"exploit-public","label":"First public exploit: Metasploit; later: PoC-in-GitHub 2022-10-10","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/http/zimbra_cpio_cve_2022_41352.rb","provenance":"source"},{"date":"2022-09-26","kind":"published","label":"Published (NVD)","url":"https://nvd.nist.gov/vuln/detail/CVE-2022-41352","provenance":"source"},{"date":"2022-10-20","kind":"exploited-reported","label":"Exploitation first reported (VulnCheck KEV evidence)","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","provenance":"source"},{"date":"2022-10-20","kind":"kev","label":"Added to CISA KEV (known ransomware use)","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","provenance":"source"},{"date":"2022-10-20","kind":"euvd-exploited","label":"ENISA EUVD: exploited","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2022-44557","provenance":"source"}],"speed":{"daysToPublicExploit":null,"firstExploitFrom":"Metasploit","daysToKev":24},"priority":{"score":79.8,"factors":[{"name":"In a KEV catalog","points":35.0,"detail":"listed in CISA KEV and VulnCheck KEV"},{"name":"Recent KEV listing","points":0.0,"detail":"added 1470 days ago"},{"name":"Known ransomware use","points":10.0,"detail":"CISA KEV and VulnCheck KEV: Known"},{"name":"EPSS percentile","points":19.97,"detail":"percentile 0.9987"},{"name":"Named in threat reports","points":0.0,"detail":"0 reports"},{"name":"Public exploit code","points":5.0,"detail":"1 NVD reference tagged Exploit; 2 PoC-in-GitHub repos; 1 Metasploit module; 1 nuclei template"},{"name":"Mentioned in OTX pulses","points":3.0,"detail":"50 pulses"},{"name":"CVSS severity","points":6.86,"detail":"base score 9.8"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]}}