Vulnerabilities

Zimbra is vulnerable to Stored Cross-Site Scripting (XSS) via the From email header during HTML reply composition in Classic UI.

Zimbra is vulnerable to Stored Cross-Site Scripting (XSS) via the From email header during HTML reply composition in Classic UI. Due to insufficient sanitization of the From header value, a remote attacker can send a crafted email containing a malicious From header with an embedded JavaScript payload. When the victim opens the message in Classic UI and clicks Reply while composing in HTML mode with reply headers disabled, the unsanitized From header content is rendered as HTML and the JavaScript payload executes in the victim's browser, potentially allowing the attacker to steal session information or perform actions on behalf of the victim. This issue was fixed in version 10.1.21

Read at NIST National Vulnerability Database (CVE API 2.0)

Vendor

Zimbra

Product

Zimbra Collaboration

CVSS v4.0

5.3 AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Fix

available

Weakness

CWE-79

Exposure class

Email

NVD status

Awaiting Analysis

• NIST National Vulnerability Database (CVE API 2.0) (nvd.nist.gov)
• CVE-2026-66912 on this site · NVD · CVE.org · Vulnpedia

Other items that share a CVE or were clustered with this one.

1. 33
   Advisory CERT Polska 2d ago

   Vulnerabilities in Zimbra Collaboration software

   CVE-2026-66911CVE-2026-66912 Zimbra