Description
Zimbra Collaboration contains a local file inclusion vulnerability caused by improper handling of user-supplied input in a REST servlet component. Due to insufficient validation of request parameters, an unauthenticated remote attacker can craft requests that force the application to include arbitrary files from within the web root directory.
Remediation
Upgrade Zimbra Collaboration Suite to the latest patched version and ensure all security updates are applied regularly.
References
Related Vulnerabilities
Jboss EAP Files or Directories Accessible to External Parties Vulnerability (CVE-2021-3717)
Liferay DXP Insertion of Sensitive Information Into Sent Data Vulnerability (CVE-2025-43768)
Undertow Improper Input Validation Vulnerability (CVE-2020-1757)
Moodle Exposure of Sensitive Information to an Unauthorized Actor Vulnerability (CVE-2013-2243)