Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-10632— Zimbra Collaboration Suite Classic Web Client Reflected Cross-Site Scripting via Document Editor Packages Parameter

Quick assessment

Affected
Zimbra Zimbra Collaboration Suite
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Zimbra 协作套件（ZCS）经典 Web 客户端中存在一个反射型跨站脚本（XSS）漏洞。攻击者可通过 文档编辑器的 参数注入 JavaScript 代码。该编辑器在将包名称插入脚本属性时未进行 HTML 编码。若与 CVE-2026-50053 结合利用，拥有普通 Zimbra 账户的攻击者即可在 URL 中提供自定义的认证令牌和文档标识符；当其他已登录用户打开该 URL 时，攻击者便能在该受害者的 Zimbra 浏览器会话中执行 JavaScript 代码。这使得攻击者能够读取邮箱数据，并冒充受害者执行已认证

CVSS 8.7 · High

Affected Version Matrix 1

VendorProduct Version RangeStatus
Zimbra Zimbra Collaboration Suite < 10.1.17 affected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-10632

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Zimbra Collaboration Suite Classic Web Client Reflected Cross-Site Scripting via Document Editor Packages Parameter
Source: CVE Program / CVE List V5
Vulnerability Description
A reflected cross-site scripting vulnerability in the Classic Web Client of Zimbra Collaboration Suite (ZCS) allows an attacker to inject JavaScript through the packages parameter of the /h/rest document editor. The editor inserts package names into script attributes without HTML encoding. When combined with CVE-2026-50053, an attacker with an ordinary Zimbra account can supply their own authentication token and document identifiers in a URL and execute JavaScript in another signed-in user's Zimbra browser session when that user opens the URL. This permits reading mailbox data and performing authenticated actions as the victim. The issue affects ZCS 10.1.16 and was remediated in 10.1.17.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
在Web页面生成时对输入的转义处理不恰当(跨站脚本)
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
Zimbra Zimbra Collaboration Suite 0 ~ 10.1.17 -

II. Public POCs for CVE-2026-10632

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-10632

请登录查看更多情报信息。

Vendor Advisories for CVE-2026-10632 (1)

Other References for CVE-2026-10632 (1)

Same Patch Batch · Zimbra · 2026-10-23 · 17 CVEs total

CVE-2026-50053 8.7 HIGH Zimbra Collaboration Suite RestFilter Request Attribute Override via Unauthenticated URL P
CVE-2026-93639 8.7 HIGH Zimbra Collaboration Suite Missing Authorization in ConfigureZimlet Enables Delegated Admi
CVE-2026-93640 7.8 HIGH Zimbra Collaboration Suite Local Privilege Escalation via Unrestricted zmunbound Sudo Conf
CVE-2026-50056 7.8 HIGH Zimbra Collaboration Suite Local Privilege Escalation via zmmailboxdmgr JVM Argument Injec
CVE-2026-50057 7.8 HIGH Zimbra Collaboration Suite Local Privilege Escalation via Unrestricted Postfix Sudo Permis
CVE-2026-93631 7.1 HIGH Zimbra Collaboration Suite OAuth Extension Cross-Site Request Forgery Enables Account Link
CVE-2026-115786 6.5 MEDIUM Zimbra Collaboration Suite Shared-File Mailbox Quota Accounting Error Enables Quota Exhaus
CVE-2026-93638 6.1 MEDIUM Zimbra Collaboration Suite Pre-Authentication Reflected Cross-Site Scripting via Login Pag
CVE-2026-93633 5.4 MEDIUM Zimbra Collaboration Suite Briefcase CSS Sanitization Bypass via Non-ASCII Stylesheet Char
CVE-2026-93629 5.3 MEDIUM Zimbra Collaboration Suite Calendar Processing Authentication Bypass via Forged iCalendar
CVE-2026-93627 5.3 MEDIUM Zimbra Collaboration Suite Calendar Processing Authentication Bypass via Forged iCalendar
CVE-2026-93628 5.3 MEDIUM Zimbra Collaboration Suite Calendar Processing Authentication Bypass via Forged iCalendar
CVE-2026-93630 4.3 MEDIUM Zimbra Collaboration Suite Email HTML Sanitizer Bypass via Hostname Canonicalization
CVE-2026-93634 4.3 MEDIUM Zimbra Collaboration Suite Cross-Account Authorization Bypass via Forged Shared-File Recor
CVE-2026-93636 4.3 MEDIUM Zimbra Collaboration Suite LDAP Filter Injection via Calendar Resource Attribute Name
CVE-2026-115785 4.3 MEDIUM Zimbra Collaboration Suite Data Source Test SMTP Command Injection via Unsanitized Email A

IV. Related Vulnerabilities

Same product: Zimbra Collaboration Suite
Same vendor: Zimbra
Same weakness: CWE-79

V. Comments for CVE-2026-10632

No comments yet

Leave a comment