CVE-2025-68645: Zimbra Webmail Classic UI RestFilter local file inclusion

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 17 September 2026. Confidence: medium.

critical priorityThe flaw is remotely reachable without authentication, rated CVSS 8.8, and listed in CISA KEV with known exploitation and a near-term remediation deadline.

What it is

Zimbra Collaboration Suite 10.0 and 10.1 mishandle user-supplied parameters in the RestFilter servlet of the Webmail Classic UI, allowing local file inclusion via crafted requests to the /h/rest endpoint. Because the flaw permits inclusion of arbitrary files from the WebRoot directory, it exposes server-side files to an unauthenticated remote attacker. The record does not specify which exact files can be read or whether code execution follows from the inclusion.

Impact

An attacker can read arbitrary files from the WebRoot directory without authenticating, potentially exposing configuration, credential or application data. The CVSS vector also rates integrity and availability impact as high, but the description only substantiates file disclosure.

Attack surface

Reached over the network through the /h/rest endpoint of the Webmail Classic UI; no authentication is required (PR:N), though the CVSS vector requires user interaction (UI:R), which the description does not explain.

Exploitation

CVE-2025-68645 was added to CISA KEV on 2026-01-22 with a remediation due date of 2026-02-12, indicating known exploitation. EPSS gives a 30-day probability of 0.49374 (98.8th percentile), and no ransomware campaign use is documented.

What to do

• Apply the vendor mitigation or fixed release per the Zimbra Security Center advisory; treat this as urgent given the KEV listing.
• If patching is not immediately possible, restrict or block external access to the /h/rest endpoint and the Webmail Classic UI.
• Follow BOD 22-01 guidance for cloud services or discontinue use of the product if no mitigation is available.
• Review and rotate credentials and secrets stored in files under the WebRoot that could have been exposed.

Detection

• Hunt web and proxy logs for requests to /h/rest with unusual or traversal-style parameters, especially from unauthenticated sources.
• Alert on access to the Webmail Classic UI RestFilter servlet from unexpected IPs or user agents.
• Monitor file access to WebRoot paths for reads initiated by the webmail process outside normal operation.
• Correlate any /h/rest activity with subsequent authentication attempts or outbound connections from the Zimbra host.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.