Zimbra is vulnerable to stored cross-site scripting (XSS) via the Content-Location MIME header in email attachments.
Zimbra is vulnerable to stored cross-site scripting (XSS) via the Content-Location MIME header in email attachments. Due to lack of sanitization of the Content-Location header, an attacker can set it to a javascript: URI. An unauthenticated remote attacker can send a crafted email to a victim; when the victim opens the email in the Zimbra web interface and clicks the attachment name, the JavaScript payload executes in the victim's browser context. This issue was fixed in version 10.1.21
Read at NIST National Vulnerability Database (CVE API 2.0)
- Vendor
- Zimbra
- Product
- Zimbra Collaboration
- CVSS v4.0
- 5.3 AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
- Fix
- available
- Weakness
- CWE-79
- Exposure class
- NVD status
- Awaiting Analysis
Why it ranks 26 (Notable)
- CVSS v4.0 5.3 medium
- Exposed product class: email
- Fix available
- Recency: items published within 24 hours gain 15, within 72 hours 6, within 7 days 2.
Links
- NIST National Vulnerability Database (CVE API 2.0) (nvd.nist.gov)
- CVE-2026-66911 on this site · NVD · CVE.org · Vulnpedia
Related coverage
Other items that share a CVE or were clustered with this one.