Skip to content

CVE record · 2 sources

CVE-2026-66911

CVSS 5.3

Zimbra is vulnerable to stored cross-site scripting (XSS) via the Content-Location MIME header in email attachments.

Vendor: Zimbra
Product: Zimbra Collaboration
CVSS v4.0: 5.3 AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Weakness: CWE-79
Exposure class: Email

Coverage

2

Every item in the archive that references this CVE, highest rank first. Headlines open the publisher.

33

Advisory CERT Polska 2d ago

Vulnerabilities in Zimbra Collaboration software

During its own research, CERT Polska has found 2 XSS vulnerabilities (CVE-2026-66911 and CVE-2026-66912) in Zimbra Collaboration software.

CVE-2026-66911 CVE-2026-66912 Zimbra
26

CVE NVD 2d ago

Zimbra is vulnerable to stored cross-site scripting (XSS) via the Content-Location MIME header in email attachments.

Zimbra is vulnerable to stored cross-site scripting (XSS) via the Content-Location MIME header in email attachments. Due to lack of sanitization of the Content-Location header, an attacker can set it to a javascript: URI. An…

CVSS 5.3 Fix available CVE-2026-66911 Zimbra