CVE-2025-48700: Zimbra Classic UI stored XSS via crafted email HTML

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 17 September 2026. Confidence: medium.

high priorityConfirmed exploitation via CISA KEV with a short remediation deadline, though CVSS is only 6.1 and EPSS probability is low.

What it is

Zimbra Collaboration Suite Classic UI fails to properly sanitize HTML content in email messages, allowing crafted tag structures and attribute values (including @import directives) to inject script. An attacker who sends a crafted email can execute arbitrary JavaScript in the recipient's session when the message is viewed. The flaw affects ZCS 8.8.15, 9.0, 10.0 and 10.1 and is listed in CISA KEV, so it is being exploited in the wild.

Impact

An attacker gains script execution in the victim's authenticated Zimbra session, enabling theft of session data and access to sensitive information visible to that user. The CVSS scope change (S:C) indicates impact can extend beyond the vulnerable component.

Attack surface

Reached remotely over the network by sending a crafted email that the victim views in the Classic UI; no authentication is required for the attacker, and the description states no additional user interaction beyond viewing the message.

Exploitation

Listed in CISA KEV with a required action deadline, confirming known exploitation; EPSS 30-day probability is 0.0169 (75.9th percentile), and no ransomware campaign use is documented.

What to do

• Apply the vendor patch or mitigation per Zimbra Security Advisories and Security Center guidance as required by CISA KEV.
• If patching is not immediately possible, follow BOD 22-01 guidance for cloud services or discontinue use of the affected Classic UI.
• Restrict or disable the Classic UI where feasible and steer users to the modern web client.
• Filter or block inbound email containing suspicious HTML structures such as @import directives in style attributes.
• Monitor vendor advisories for updated fixed versions covering 8.8.15, 9.0, 10.0 and 10.1.

Detection

• Search mail gateway and Zimbra logs for messages containing @import directives or unusual tag/attribute structures in HTML bodies.
• Monitor for anomalous JavaScript execution or unexpected outbound requests originating from Zimbra web sessions.
• Review authentication and session logs for suspicious activity following viewing of crafted emails.
• Hunt for known exploitation indicators against the CISA KEV entry and vendor advisories.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.