CVE Watch10 sept 2026

CVE-2022-41352

Synacor Zimbra Collaboration Suite (ZCS) Arbitrary File Upload Vulnerability

CVSS

9.8

Crítico

EPSS

95.5%

p100

KEV

SÍ

20 oct 2022

Exploit Today

0-100

Publicado: 26 sept 2022 · Última mod.: 10 sept 2026 · CWE-22

EPSS · 30d

95.5%EPSS · 30 días95.5%

2026-09-162026-10-14

Ficha del catálogo KEV

Producto

Synacor / Zimbra Collaboration Suite (ZCS)

Vulnerabilidad

Synacor Zimbra Collaboration Suite (ZCS) Arbitrary File Upload Vulnerability

Añadido a KEV

20 oct 2022

Remediar antes de

10 nov 2022

Uso conocido en ransomware

Sí

Descripción resumida

Synacor Zimbra Collaboration Suite (ZCS) allows an attacker to upload arbitrary files using cpio package to gain incorrect access to any other user accounts.

Acción requerida

Apply updates per vendor instructions.

Notas

https://wiki.zimbra.com/wiki/Security_Center; https://nvd.nist.gov/vuln/detail/CVE-2022-41352

Descripción técnica

An issue was discovered in Zimbra Collaboration (ZCS) 8.8.15 and 9.0. An attacker can upload arbitrary files through amavis via a cpio loophole (extraction to /opt/zimbra/jetty/webapps/zimbra/public) that can lead to incorrect access to any other user accounts. Zimbra recommends pax over cpio. Also, pax is in the prerequisites of Zimbra on Ubuntu; however, pax is no longer part of a default Red Hat installation after RHEL 6 (or CentOS 6). Once pax is installed, amavis automatically prefers it over cpio.

Referencias oficiales

CVEs relacionados

CVECVSSEPSSKEVRExplotTítuloVis.

CVE-2026-41544—

—

———A path traversal vulnerability has been reported to affect QcalAgent. If a remote attacker gains a user account, they can then exploit the vulnerability to read the contents of unexpected files or system data. We have already fixed the vulnerability in the following version: QcalAgent 1.1.10 and later6h CVE-2026-24718—

—

———A path traversal vulnerability has been reported to affect Qsync Central. If a remote attacker gains a user account, they can then exploit the vulnerability to read the contents of unexpected files or system data. We have already fixed the vulnerability in the following version: Qsync Central 5.0.0.7 and later Qsync Central 5.1.0.3 and later Qsync Central 5.2.0.5 and later Qsync Central 5.3.0.2 and later6h CVE-2025-66275—

—

———A path traversal vulnerability has been reported to affect Video Station. If a remote attacker gains a user account, they can then exploit the vulnerability to read the contents of unexpected files or system data. We have already fixed the vulnerability in the following version: Video Station 5.8.5 and later6h CVE-2025-66272—

—

———A flaw was found in OpenSSH. During an sftp copy, a malicious server can supply an empty name, a slash-only path, or a ".." basename that sftp uses as the local destination, writing outside the directory the user selected.7h CVE-2026-626645.4 MED

—

——0FileRise is a self-hosted web-based file manager with multi-file upload, editing, and batch operations. Prior to 3.19.0, FileRise validates the complete folderName string but does not reject dot-dot path segments before FolderModel::createFolder() constructs and creates the destination. An authenticated low-privileged user with a valid CSRF token and create or owner permission on the parent can submit traversal segments to POST /api/folder/createFolder.php and create directories outside UPLOAD_DIR wherever the web-server account can write. This issue is fixed in version 3.19.0.16h