CVE-2018-6882: Zimbra Collaboration Suite XSS via attachment Content-Location header

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 17 September 2026. Confidence: high.

high priorityAlthough CVSS is medium (6.1), the vulnerability is in CISA KEV with known ransomware use and high EPSS, indicating active exploitation and elevated risk for unpatched Zimbra deployments.

What it is

Zimbra Collaboration Suite (ZCS) before 8.7 Patch 1 and 8.8.x before 8.8.7 fails to properly sanitize the Content-Location header of an email attachment in ZmMailMsgView.getAttachmentLinkHtml, allowing arbitrary web script or HTML injection. Because the flaw lives in the webmail attachment rendering path, a crafted email can execute script in the victim's authenticated Zimbra session.

Impact

An attacker can run arbitrary script in the context of the victim's Zimbra webmail session, enabling session theft, mailbox data exfiltration, or actions performed as the victim. The CVSS scope change (S:C) reflects that the injected script can affect resources beyond the vulnerable component.

Attack surface

Reached remotely over the network by sending an email with a malicious Content-Location header in an attachment; the victim must open or view the attachment in Zimbra webmail, so user interaction is required and no prior authentication on the attacker's side is needed.

Exploitation

CVE-2018-6882 is listed in CISA KEV (added 2022-04-19) with known ransomware campaign use, and EPSS shows a 30-day probability of 0.25268 (97.8th percentile); a public exploit reference is tagged in the advisory. This indicates active exploitation in the wild, not just theoretical risk.

What to do

• Upgrade Zimbra Collaboration Suite to 8.7 Patch 1 or 8.8.7 (or later) as directed by the vendor advisory.
• If immediate patching is not possible, restrict or disable webmail attachment preview/rendering for untrusted senders.
• Enforce email filtering to strip or quarantine messages with suspicious Content-Location headers in attachments.
• Apply the vendor security advisory guidance and monitor for follow-up Zimbra security releases.
• Segment and harden Zimbra webmail exposure (limit internet-facing access, enforce MFA) to reduce session theft impact.

Detection

• Search Zimbra webmail/proxy logs for requests or responses containing Content-Location headers with script-like or HTML payloads in attachment handling.
• Monitor for anomalous JavaScript execution or outbound requests originating from Zimbra webmail sessions (e.g., unusual referrers or callback domains).
• Alert on emails with attachments whose Content-Location header contains angle brackets, script tags, or encoded HTML entities.
• Review Zimbra server and client-side logs for attachment view events correlated with known malicious sender domains or IOCs.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.