CVE-2022-41352

Synacor Zimbra Collaboration Suite (ZCS): Arbitrary File Upload

As of , CVE-2022-41352 in Synacor Zimbra Collaboration Suite (ZCS) is on CISA's list of exploited vulnerabilities: CISA listed it on . Our patch-first group: Patch this week.

Exploited
Yes: CISA listed it on 20 October 2022
US federal deadline
10 November 202221 days after CISA listed it. US federal civilian agencies must fix it by then.
Used in ransomware campaigns
KnownCISA changed it from Unknown to Known on 9 September 2026.
EPSS score
0.95Higher than 99% of the CVEs EPSS scores. EPSS estimates the chance of exploitation activity in the next 30 days.
EPSS when listed
0.15 on 20 October 2022EPSS on the day CISA listed it.
Public exploit
1 Metasploit module
Fix
Vendor advice: wiki.zimbra.comLinks below, from CISA's entry.

What CISA says to do

Apply updates per vendor instructions.

CISA's required action

What the flaw is

Synacor Zimbra Collaboration Suite (ZCS) allows an attacker to upload arbitrary files using cpio package to gain incorrect access to any other user accounts.

CISA's description

An issue was discovered in Zimbra Collaboration (ZCS) 8.8.15 and 9.0. An attacker can upload arbitrary files through amavis via a cpio loophole (extraction to /opt/zimbra/jetty/webapps/zimbra/public) that can lead to incorrect access to any other user accounts. Zimbra recommends pax over cpio. Also, pax is in the prerequisites of Zimbra on Ubuntu; however, pax is no longer part of a default Red Hat installation after RHEL 6 (or CentOS 6). Once pax is installed, amavis automatically prefers it over cpio.

The CVE record's description, from mitre

CVE published
26 September 2022
Assigned by
mitre
CVSS
9.8 Critical (CVSS 3.1, from CISA-ADP)
CWE-22
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
CISA SSVC, exploitation
active
CISA SSVC, automatable
yes
CISA SSVC, technical impact
total

Timeline

  1. The CVE record was published.
  2. CISA added it to its list of exploited vulnerabilities.
  3. The US federal deadline to fix it.
  4. CISA changed its entry. Renamed from Zimbra Collaboration (ZCS) to Synacor Zimbra Collaboration Suite (ZCS). Edited: description and name.
  5. CISA changed its entry. Ransomware use: Unknown to Known.

Public exploits

Facts from Metasploit's module list and Exploit-DB's index; we never copy exploit code.

  • Metasploit: TAR Path Traversal in Zimbra (CVE-2022-41352)exploit module, rank excellent

Zimbra Collaboration Suite (ZCS): other exploited entries

VulnerabilityProductOur groupListedDeadlineEPSS
CVE-2026-73570OS Command InjectionSynacor Zimbra Collaboration Suite (ZCS)Patch nowForensic triage required by CISA0.72
CVE-2019-9621Server-Side Request Forgery (SSRF)Synacor Zimbra Collaboration Suite (ZCS)Patch this weekMetasploit module; EPSS 0.81; verified Exploit-DB entry0.81
CVE-2019-9670Improper Restriction of XML External Entity ReferenceSynacor Zimbra Collaboration Suite (ZCS)Patch this weekMetasploit module; EPSS 0.99; verified Exploit-DB entry0.99
CVE-2022-27925Arbitrary File UploadSynacor Zimbra Collaboration Suite (ZCS)Patch this weekRansomware use; Metasploit module; EPSS 0.990.99
CVE-2022-37042Authentication BypassSynacor Zimbra Collaboration Suite (ZCS)Patch this weekRansomware use; Metasploit module; EPSS 0.920.92
CVE-2023-34192Cross-Site Scripting (XSS)Synacor Zimbra Collaboration Suite (ZCS)Patch this weekEPSS 0.770.77
CVE-2024-45519Command ExecutionSynacor Zimbra Collaboration Suite (ZCS)Patch this weekEPSS 0.990.99
CVE-2022-27924Command InjectionSynacor Zimbra Collaboration Suite (ZCS)Patch this weekRansomware use; EPSS 0.940.94
CVE-2018-6882Cross-Site Scripting (XSS)Synacor Zimbra Collaboration Suite (ZCS)Patch this weekRansomware use0.30
CVE-2025-68645PHP Remote File InclusionSynacor Zimbra Collaboration Suite (ZCS)Patch soon0.49

All 17 entries for Zimbra Collaboration Suite (ZCS)

Read further