This is a summary of the AI-generated 10-question deep analysis. The full version (longer answers, follow-up Q&A, related CVEs) requires login.
Read the full analysis โ
Q1What is this vulnerability? (Essence + Consequences)
๐จ **Essence**: Zimbra Collaboration suffers from a **Local File Inclusion (LFI)** vulnerability.โฆ
๐ก๏ธ **Root Cause**: Improper handling of user-supplied parameters in the **RestFilter servlet**. ๐ **CWE**: While not explicitly mapped in the data, this is a classic **LFI** flaw (often CWE-22 or CWE-93).โฆ
๐ฏ **Affected Versions**: Zimbra Collaboration **10.0** and **10.1**. ๐ฆ **Component**: The **RestFilter servlet** within the Webmail Classic UI. โ ๏ธ Ensure you are running these specific versions before worrying.
Q4What can hackers do? (Privileges/Data)
๐ต๏ธ **Attacker Actions**: Unauthenticated remote attackers can include **arbitrary files** from the WebRoot. ๐ This allows reading of sensitive internal files.โฆ
๐ฃ **Public Exploits**: **YES**. ๐ Multiple PoCs are available on GitHub (e.g., Ashwesker, ProjectDiscovery Nuclei templates). ๐ Wild exploitation is highly likely given the ease of access and public tools.
Q7How to self-check? (Features/Scanning)
๐ **Self-Check**: Use **Nuclei** templates (provided in references) to scan for the `/h/rest` endpoint anomalies.โฆ
๐ฉน **Official Fix**: The data does not list a specific patch version. ๐ Published: 2025-12-22. ๐ **Action**: Check the [Zimbra Security Center](https://wiki.zimbra.com/wiki/Security_Center) for the latest updates.โฆ
๐ง **No Patch Workaround**: Block external access to the `/h/rest` endpoint via **WAF** or **Firewall** rules. ๐ซ Restrict access to the Zimbra web interface to trusted IPs only.โฆ
โก **Urgency**: **HIGH**. ๐ฅ **Priority**: **P1**. ๐จ Unauthenticated LFI in a major email platform is a critical risk. ๐โโ๏ธ **Recommendation**: Patch immediately or apply strict network controls. Do not ignore this!