CVE-2022-27925: Zimbra Collaboration mboximport ZIP path traversal allows arbitrary file upload

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 16 September 2026. Confidence: high.

critical priorityThe vulnerability is in CISA KEV with known ransomware use, has a very high EPSS score, and allows an authenticated administrator to achieve arbitrary file write and likely remote code execution.

What it is

Zimbra Collaboration Suite 8.8.15 and 9.0 mboximport functionality accepts a ZIP archive and extracts files without properly validating paths, allowing directory traversal. An authenticated administrator can upload arbitrary files to the system, which can lead to code execution or full compromise of the mail server.

Impact

An attacker with administrative rights can write files to arbitrary locations on the server, enabling web shell placement, configuration tampering, or remote code execution. This can result in complete compromise of the Zimbra host and access to mail data.

Attack surface

The flaw is reachable over the network via the mboximport feature, requiring authentication with administrator privileges and no user interaction. The CVSS vector confirms network access, low complexity, and high privileges required.

Exploitation

CVE-2022-27925 is listed in CISA KEV with known ransomware campaign use, and EPSS indicates a very high probability of exploitation. Public exploit references are available, confirming active exploitation in the wild.

What to do

• Apply the vendor updates referenced in Zimbra Security Advisories and release notes (e.g., 9.0.0 P24) as soon as possible.
• Restrict administrative access to the Zimbra administration console and mboximport functionality to trusted networks or IP allowlists.
• Enforce strong authentication and monitor for unauthorized administrative account usage.
• If patching is not immediately possible, consider disabling or restricting the mboximport feature until updates are applied.
• Review and harden file upload and extraction paths to prevent traversal, following vendor guidance.

Detection

• Monitor Zimbra server logs for mboximport requests, especially those containing ZIP archives with path traversal sequences (e.g., ../).
• Alert on unexpected file creation or modification in web-accessible directories or system paths outside normal Zimbra data directories.
• Hunt for known web shell indicators or suspicious files in Zimbra web directories following mboximport activity.
• Correlate administrative login events with subsequent file upload or extraction activity for anomalous behavior.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.