CVE-2013-7091: Zimbra Collaboration Suite directory traversal in skin parameter

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 18 September 2026. Confidence: high.

high priorityUnauthenticated network-reachable file disclosure with public exploit code and very high EPSS, and it can chain to code execution via exposed LDAP credentials.

What it is

Zimbra 7.2.2 and 8.0.2 contains a directory traversal flaw in the /res/I18nMsg,AjxMsg,ZMsg,ZmMsg,AjxKeys,ZmKeys,ZdMsg,Ajx%20TemplateMsg.js.zgz endpoint. A remote attacker can supply a .. sequence in the skin parameter to read arbitrary files. The flaw matters because file disclosure can expose credentials that enable follow-on code execution.

Impact

An attacker gains read access to arbitrary files on the server. The advisory notes this can be leveraged to execute arbitrary code by obtaining LDAP credentials and accessing the service/admin/soap API.

Attack surface

Reachable over the network via HTTP requests to the affected /res/ endpoint with a crafted skin parameter. The CVSS vector AV:N/AC:L/Au:N indicates no authentication and no user interaction are required.

Exploitation

Not listed in CISA KEV, but EPSS is 0.86311 (99.7th percentile) and an Exploit-DB entry is tagged Exploit, indicating public exploit code exists and exploitation is likely.

What to do

• Upgrade Zimbra Collaboration Suite to a version later than 7.2.2/8.0.2 that fixes the traversal.
• If immediate upgrade is not possible, restrict or block external access to the /res/ path and the affected .js.zgz endpoint.
• Rotate LDAP and administrative credentials that may have been exposed through file reads.
• Review and restrict the privileges of the Zimbra service account to limit post-exploitation impact.
• Monitor for and block traversal sequences such as ../ in requests to the skin parameter.

Detection

• Search web/proxy logs for requests to /res/ containing .. or encoded traversal sequences in the skin parameter.
• Alert on access to the specific .js.zgz filenames listed in the advisory from untrusted sources.
• Monitor for anomalous reads of sensitive files (e.g., configuration or credential files) by the Zimbra process.
• Correlate file-read activity with subsequent calls to service/admin/soap for signs of credential abuse.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.