CVE Watch—

CVE-2022-27925

Synacor Zimbra Collaboration Suite (ZCS) Arbitrary File Upload Vulnerability

CVSS

—

No CVSS

EPSS

98.6%

p100

KEV

YES

Aug 11, 2022

Exploit Today

0-100

Published: — · Last modified: —

EPSS · 30d

98.2%EPSS · 30 days98.6%

2026-06-302026-07-16

KEV catalog record

Product

Synacor / Zimbra Collaboration Suite (ZCS)

Vulnerability

Synacor Zimbra Collaboration Suite (ZCS) Arbitrary File Upload Vulnerability

Added to KEV

Aug 11, 2022

Remediate by

Sep 1, 2022

Known ransomware use

Yes

Summary description

Synacor Zimbra Collaboration Suite (ZCS) contains flaw in the mboximport functionality, allowing an authenticated attacker to upload arbitrary files to perform remote code execution. This vulnerability was chained with CVE-2022-37042 which allows for unauthenticated remote code execution.

Required action

Apply updates per vendor instructions.

Notes

https://blog.zimbra.com/2022/08/authentication-bypass-in-mailboximportservlet-vulnerability/; https://nvd.nist.gov/vuln/detail/CVE-2022-27925

Related CVEs

CVECVSSEPSSKEVRExploitTitleMod.

CVE-2024-45519—

100.0%

KEV—80Synacor Zimbra Collaboration Suite (ZCS) Command Execution Vulnerability—CVE-2019-9670—

100.0%

KEV—80Synacor Zimbra Collaboration Suite (ZCS) Improper Restriction of XML External Entity Reference—CVE-2022-41352—

99.9%

KEV—80Synacor Zimbra Collaboration Suite (ZCS) Arbitrary File Upload Vulnerability—CVE-2022-37042—

99.8%

KEV—80Synacor Zimbra Collaboration Suite (ZCS) Authentication Bypass Vulnerability—CVE-2022-27924—

99.7%

KEV—80Synacor Zimbra Collaboration Suite (ZCS) Command Injection Vulnerability—CVE-2019-9621—

99.6%

KEV—80Synacor Zimbra Collaboration Suite (ZCS) Server-Side Request Forgery (SSRF) Vulnerability—