Zimbra Collaboration Suite: Reflected XSS in Classic Web Client document editor
Summary
A reflected cross-site scripting vulnerability in the Classic Web Client of Zimbra Collaboration Suite allows JavaScript injection through the packages parameter of the document editor at /h/rest. Combined with CVE-2026-50053, an attacker with a regular Zimbra account can craft a URL that executes JavaScript in another signed-in user's browser session when the victim opens it. This can expose mailbox data and allow actions performed as the victim. The attack requires user interaction.
Affected
- Zimbra Collaboration Suite (ZCS) 10.1.16 as tested by the researcher
- CNA range: all versions below 10.1.17 (older releases presumably affected, not verified)
Fixed in
- ZCS 10.1.17
Workaround
- No vendor-published workaround known.
- Limit access to the Classic Web Client to trusted networks where possible.
Exploitation
- Exploited in the wild: no evidence found.
- Known public proof of concept: none found.
- CISA SSVC: exploitation none, automatable no, technical impact total.
Our recommendation
- Check whether ZCS instances run a version below 10.1.17 and prioritise the upgrade, especially for internet-facing servers or servers with many users.
- Do not rely on 10.1.17 alone for CVE-2026-50053: its fix status is unclear, so review the vendor advisory and apply all later updates.
- Warn users not to open unexpected links while signed in to Zimbra and monitor for unusual mailbox activity.
- Confirm exact affected versions in the Zimbra advisory.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Zimbra Security Advisories wiki.zimbra.com
- Zimbra Security Center wiki.zimbra.com
- Rapid7: Breaking Zimbra's Identity Boundaries (Part 1) www.rapid7.com
- Strix: CVE-2026-10632 www.strix.ai
- Strix: CVE-2026-50053 www.strix.ai
- NVD via Vulners: CVE-2026-10632 vulners.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 00:30.
Original description (NVD)
A reflected cross-site scripting vulnerability in the Classic Web Client of Zimbra Collaboration Suite (ZCS) allows an attacker to inject JavaScript through the packages parameter of the /h/rest document editor. The editor inserts package names into script attributes without HTML encoding. When combined with CVE-2026-50053, an attacker with an ordinary Zimbra account can supply their own authentication token and document identifiers in a URL and execute JavaScript in another signed-in user's Zimbra browser session when that user opens the URL. This permits reading mailbox data and performing authenticated actions as the victim. The issue affects ZCS 10.1.16 and was remediated in 10.1.17.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.