Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-93633— Zimbra Collaboration Suite Briefcase CSS Sanitization Bypass via Non-ASCII Stylesheet Characters

Quick assessment

Affected
Zimbra Zimbra Collaboration Suite
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Zimbra 协作套件（ZCS）中存在一个 CSS 清理漏洞。拥有 Briefcase（个人文件柜）访问权限的已认证用户可以发布一份文档，该文档会在 Zimbra 域名下渲染由攻击者控制的内容。当处理包含非 ASCII 字符的样式表时，DefangFilter 会将末尾的 ASCII 片段直接追加，而未经过清理。因此，以 application/x-zimbra-doc 类型存储的 HTML 内容可能保留通常会被正常清理器移除的 CSS URL 引用。攻击者可以共享一份经过精心构造的文档，该文档会加载外部资源，并利

CVSS 5.4 · Medium

Affected Version Matrix 1

VendorProduct Version RangeStatus
Zimbra Zimbra Collaboration Suite ≤ 10.1.20 affected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-93633

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Zimbra Collaboration Suite Briefcase CSS Sanitization Bypass via Non-ASCII Stylesheet Characters
Source: CVE Program / CVE List V5
Vulnerability Description
A CSS sanitization vulnerability in Zimbra Collaboration Suite (ZCS) allows an authenticated user with Briefcase access to publish a document that displays attacker-controlled content under the Zimbra origin. When processing a stylesheet containing non-ASCII characters, DefangFilter appends the final ASCII segment without sanitizing it. HTML stored as application/x-zimbra-doc can therefore retain CSS URL references that the normal sanitizer removes. An attacker can share a crafted document that loads external resources and displays a credential-collection form using Zimbra's own visual assets. Exploitation requires the victim to open the document in a browser that renders the content type inline; credential theft additionally requires form submission. ZCS 10.1.16 and 10.1.20 are affected.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
在Web页面生成时对输入的转义处理不恰当(跨站脚本)
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
Zimbra Zimbra Collaboration Suite 0 ~ 10.1.20 -

II. Public POCs for CVE-2026-93633

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-93633

请登录查看更多情报信息。

Vendor Advisories for CVE-2026-93633 (1)

Other References for CVE-2026-93633 (1)

Same Patch Batch · Zimbra · 2026-10-23 · 17 CVEs total

CVE-2026-10632 8.7 HIGH Zimbra Collaboration Suite Classic Web Client Reflected Cross-Site Scripting via Document
CVE-2026-50053 8.7 HIGH Zimbra Collaboration Suite RestFilter Request Attribute Override via Unauthenticated URL P
CVE-2026-93639 8.7 HIGH Zimbra Collaboration Suite Missing Authorization in ConfigureZimlet Enables Delegated Admi
CVE-2026-93640 7.8 HIGH Zimbra Collaboration Suite Local Privilege Escalation via Unrestricted zmunbound Sudo Conf
CVE-2026-50056 7.8 HIGH Zimbra Collaboration Suite Local Privilege Escalation via zmmailboxdmgr JVM Argument Injec
CVE-2026-50057 7.8 HIGH Zimbra Collaboration Suite Local Privilege Escalation via Unrestricted Postfix Sudo Permis
CVE-2026-93631 7.1 HIGH Zimbra Collaboration Suite OAuth Extension Cross-Site Request Forgery Enables Account Link
CVE-2026-115786 6.5 MEDIUM Zimbra Collaboration Suite Shared-File Mailbox Quota Accounting Error Enables Quota Exhaus
CVE-2026-93638 6.1 MEDIUM Zimbra Collaboration Suite Pre-Authentication Reflected Cross-Site Scripting via Login Pag
CVE-2026-93629 5.3 MEDIUM Zimbra Collaboration Suite Calendar Processing Authentication Bypass via Forged iCalendar
CVE-2026-93627 5.3 MEDIUM Zimbra Collaboration Suite Calendar Processing Authentication Bypass via Forged iCalendar
CVE-2026-93628 5.3 MEDIUM Zimbra Collaboration Suite Calendar Processing Authentication Bypass via Forged iCalendar
CVE-2026-93630 4.3 MEDIUM Zimbra Collaboration Suite Email HTML Sanitizer Bypass via Hostname Canonicalization
CVE-2026-93634 4.3 MEDIUM Zimbra Collaboration Suite Cross-Account Authorization Bypass via Forged Shared-File Recor
CVE-2026-93636 4.3 MEDIUM Zimbra Collaboration Suite LDAP Filter Injection via Calendar Resource Attribute Name
CVE-2026-115785 4.3 MEDIUM Zimbra Collaboration Suite Data Source Test SMTP Command Injection via Unsanitized Email A

IV. Related Vulnerabilities

Same product: Zimbra Collaboration Suite
Same vendor: Zimbra
Same weakness: CWE-79

V. Comments for CVE-2026-93633

No comments yet

Leave a comment