What is CVE-2025-68645?

CVE-2025-68645 is a Local File Inclusion vulnerability in the Classic Webmail UI of Zimbra Collaboration Suite (ZCS) versions 10.0 and 10.1. It allows an unauthenticated attacker to include arbitrary files from the server's WebRoot directory by manipulating request parameters sent to the /h/rest endpoint, potentially leading to full server compromise.

Does the attacker need credentials to exploit this vulnerability?

No, the attacker does not need any Zimbra credentials (PR:N). However, user interaction is required (UI:R), meaning the attack typically requires a victim to click a crafted link or visit a page that triggers the malicious request to the Zimbra server. This makes phishing the most likely delivery mechanism.

Is only the Classic UI affected?

Yes, CVE-2025-68645 specifically affects the Classic Webmail UI and its RestFilter servlet. The Modern UI uses a different architecture and request handling mechanism. However, many Zimbra deployments still have the Classic UI enabled alongside or instead of the Modern UI. Even if users primarily use the Modern UI, the Classic UI endpoints may still be accessible and exploitable.

Which Zimbra versions should I upgrade to?

For ZCS 10.0, upgrade to version 10.0.18 or later. For ZCS 10.1, upgrade to version 10.1.13 or later. Check the Zimbra Security Center for the specific patch or update package for your deployment.

CVE-2025-68645

HIGH(8.8)KEVElevated Risk

Synacor Zimbra Collaboration Suite (ZCS) PHP Remote File Inclusion Vulnerability

Description

A Local File Inclusion (LFI) vulnerability exists in the Webmail Classic UI of Zimbra Collaboration (ZCS) 10.0 and 10.1 because of improper handling of user-supplied request parameters in the RestFilter servlet. An unauthenticated remote attacker can craft requests to the /h/rest endpoint to influence internal request dispatching, allowing inclusion of arbitrary files from the WebRoot directory.

KEV Information

Vendor

Synacor

Product

Zimbra Collaboration Suite (ZCS)

Date Added

January 22, 2026

Due Date

February 12, 2026

Required Action

Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

CVSS Score

Vector String

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:HOpen in Calculator

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

Exploitability Score

2.8

Impact Score

5.9

CWEs

CWE-98PHP File Inclusion

Improper Control of Filename for Include/Require Statement in PHP Program

Affected Products

Vendor	Product	Version
synacor	zimbra collaboration suite	>= 10.0.0, < 10.0.18; >= 10.1.0, < 10.1.13

References

https://wiki.zimbra.com/wiki/Security_Center(Release Notes, Vendor Advisory)
https://wiki.zimbra.com/wiki/Zimbra_Responsible_Disclosure_Policy(Product)
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-68645(US Government Resource)

CVSS Score

8.8

HIGH(8.8)

EPSS Score

EPSS Score31.77%

EPSS Percentile98.1%

Dates

PublishedDecember 22, 2025

Last ModifiedJune 17, 2026

StatusAnalyzed

CVSS Versionv3.1

Quick Links

Back to CVE Database

Need Help With Vulnerability Management?

Our security experts can help you prioritize and remediate vulnerabilities effectively.

Get in Touch

CVE-2025-68645

Description

KEV Information

CVSS Score

CWEs

Affected Products

References

CVSS Score

EPSS Score

Dates

Quick Links

Need Help With Vulnerability Management?

Platform

Resources

Company

Latest Articles