Skip to content

RadarReport an incidentReport

CVE-2025-68645

Synacor Zimbra Collaboration Suite

CVSS 3.1: 8.8 high
CISA KEV: Exploited · listed 22 Jan 2026

Technical details

Weakness: CWE-98
EPSS · 05 Nov 2026: 48.87% · p99
Public resources: 8
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Listed in CISA KEV on 22 Jan 2026 (Synacor Zimbra Collaboration Suite (ZCS) PHP Remote File Inclusion Vulnerability). CISA has evidence this flaw has been exploited.

No VulnCrest analysis published for this CVE yet. Below is the original CNA/NVD description, unmodified.

Description

A Local File Inclusion (LFI) vulnerability exists in the Webmail Classic UI of Zimbra Collaboration (ZCS) 10.0 and 10.1 because of improper handling of user-supplied request parameters in the RestFilter servlet. An unauthenticated remote attacker can craft requests to the /h/rest endpoint to influence internal request dispatching, allowing inclusion of arbitrary files from the WebRoot directory.

Exploits & detection

ExploitMaxMnMl/zimbramail-CVE-2025-68645-poc · github · ★ 3 · discovered

Unreviewed third-party code. Fake PoCs often contain malware — read the code before running it.

Exploit0xBlackash/CVE-2025-68645 · github · ★ 2 · discovered

Unreviewed third-party code. Fake PoCs often contain malware — read the code before running it.

Exploitcodeb0ssx/CVE-2025-68645-PoC · github · ★ 2 · discovered

Unreviewed third-party code. Fake PoCs often contain malware — read the code before running it.

ExploitHarisAidhin/Poc_CVE-2025-68645 · github · ★ 1 · discovered

Unreviewed third-party code. Fake PoCs often contain malware — read the code before running it.

ExploitAshwesker/Ashwesker-CVE-2025-68645 · github · ★ 0 · discovered

Unreviewed third-party code. Fake PoCs often contain malware — read the code before running it.

ExploitCrow5-oss/CVE-2025-68645 · github · ★ 0 · discovered

Unreviewed third-party code. Fake PoCs often contain malware — read the code before running it.

Exploitfaysalferdous/CVE-2025-68645-Exploiting-Zimbra-Webmail-LFI-Vulnerability · github · ★ 0 · discovered

Unreviewed third-party code. Fake PoCs often contain malware — read the code before running it.

Detection templateZimbra Collaboration - Local File Inclusion · nuclei · discovered

Timeline

Published: 22 Dec 2025
Last modified upstream: 04 Nov 2026
Added to CISA KEV: 22 Jan 2026

Sources & licenses

CVE / CVSS / CWE

NVD record ↗ (unmodified). This product uses the NVD API but is not endorsed or certified by the NVD. CVE® © The MITRE Corporation.

Exploitation

CISA KEV (CC0) · EPSS by FIRST.org

References used for the analysis

https://wiki.zimbra.com/wiki/Security_Center (Release Notes, Vendor Advisory)
https://wiki.zimbra.com/wiki/Zimbra_Responsible_Disclosure_Policy (Product)
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-68645 (US Government Resource)

Analysis, summary and remediation

© VulnCrest