CVE-2022-27925

Synacor Zimbra Collaboration Suite (ZCS): Arbitrary File Upload

As of , CVE-2022-27925 in Synacor Zimbra Collaboration Suite (ZCS) is on CISA's list of exploited vulnerabilities: CISA listed it on . Our patch-first group: Patch this week.

Exploited
Yes: CISA listed it on 11 August 2022
US federal deadline
1 September 202221 days after CISA listed it. US federal civilian agencies must fix it by then.
Used in ransomware campaigns
KnownCISA changed it from Unknown to Known on 4 April 2025.
EPSS score
0.99Higher than 99% of the CVEs EPSS scores. EPSS estimates the chance of exploitation activity in the next 30 days.
EPSS when listed
0.01 on 11 August 2022EPSS on the day CISA listed it.
Public exploit
1 Metasploit module
Fix
Vendor advice: blog.zimbra.comLinks below, from CISA's entry.

What CISA says to do

Apply updates per vendor instructions.

CISA's required action

What the flaw is

Synacor Zimbra Collaboration Suite (ZCS) contains flaw in the mboximport functionality, allowing an authenticated attacker to upload arbitrary files to perform remote code execution. This vulnerability was chained with CVE-2022-37042 which allows for unauthenticated remote code execution.

CISA's description

Zimbra Collaboration (aka ZCS) 8.8.15 and 9.0 has mboximport functionality that receives a ZIP archive and extracts files from it. An authenticated user with administrator rights has the ability to upload arbitrary files to the system, leading to directory traversal.

The CVE record's description, from mitre

CVE published
20 April 2022
Assigned by
mitre
CVSS
7.2 High (CVSS 3.1, from CISA-ADP)
CWE-22
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
CISA SSVC, exploitation
active
CISA SSVC, automatable
yes
CISA SSVC, technical impact
total

Timeline

  1. The CVE record was published.
  2. CISA added it to its list of exploited vulnerabilities.
  3. The US federal deadline to fix it.
  4. CISA changed its entry. Renamed from Zimbra Collaboration (ZCS) to Synacor Zimbra Collaboration Suite (ZCS). Edited: description and name.
  5. CISA changed its entry. Ransomware use: Unknown to Known.

Public exploits

Facts from Metasploit's module list and Exploit-DB's index; we never copy exploit code.

  • Metasploit: Zip Path Traversal in Zimbra (mboximport) (CVE-2022-27925)exploit module, rank excellent

Zimbra Collaboration Suite (ZCS): other exploited entries

VulnerabilityProductOur groupListedDeadlineEPSS
CVE-2026-73570OS Command InjectionSynacor Zimbra Collaboration Suite (ZCS)Patch nowForensic triage required by CISA0.72
CVE-2019-9621Server-Side Request Forgery (SSRF)Synacor Zimbra Collaboration Suite (ZCS)Patch this weekMetasploit module; EPSS 0.81; verified Exploit-DB entry0.81
CVE-2019-9670Improper Restriction of XML External Entity ReferenceSynacor Zimbra Collaboration Suite (ZCS)Patch this weekMetasploit module; EPSS 0.99; verified Exploit-DB entry0.99
CVE-2022-41352Arbitrary File UploadSynacor Zimbra Collaboration Suite (ZCS)Patch this weekRansomware use; Metasploit module; EPSS 0.950.95
CVE-2022-37042Authentication BypassSynacor Zimbra Collaboration Suite (ZCS)Patch this weekRansomware use; Metasploit module; EPSS 0.920.92
CVE-2023-34192Cross-Site Scripting (XSS)Synacor Zimbra Collaboration Suite (ZCS)Patch this weekEPSS 0.770.77
CVE-2024-45519Command ExecutionSynacor Zimbra Collaboration Suite (ZCS)Patch this weekEPSS 0.990.99
CVE-2022-27924Command InjectionSynacor Zimbra Collaboration Suite (ZCS)Patch this weekRansomware use; EPSS 0.940.94
CVE-2018-6882Cross-Site Scripting (XSS)Synacor Zimbra Collaboration Suite (ZCS)Patch this weekRansomware use0.30
CVE-2025-68645PHP Remote File InclusionSynacor Zimbra Collaboration Suite (ZCS)Patch soon0.49

All 17 entries for Zimbra Collaboration Suite (ZCS)

Read further