CVE-2019-9670 Synacor Zimbra Collaboration Suite (ZCS) Improper Restriction of XML External Entity Reference

Exploited in the wild Critical 9.8 Published 29 May 2019 Updated 21 Oct 2025

An XML External Entity injection vulnerability in Zimbra's mailboxd component allows attackers to read sensitive files or cause denial of service.

Exploited in the wild: Since 10 Jan 2022
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2019-9670?

CVE-2019-9670 is a critical vulnerability in Synacor Zimbra Collaboration Suite, published on 29 May 2019. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

mailboxd component in Synacor Zimbra Collaboration Suite 8.7.x before 8.7.11p10 has an XML External Entity injection (XXE) vulnerability, as demonstrated by Autodiscover/Autodiscover.xml.

Weakness: CWE-611

Which versions are affected by CVE-2019-9670?

It affects 1 product.

Products include Synacor Zimbra Collaboration Suite.

How do I fix CVE-2019-9670?

No fix has been published for CVE-2019-9670 yet. Limit exposure of the affected software until one is available. US federal agencies must fix it by 10 Jul 2022.

Is CVE-2019-9670 being exploited?

Yes. Attackers have exploited CVE-2019-9670 in the wild since at least 10 Jan 2022.

Public exploit code: 1 Metasploit module, 4 Exploit-DB entries, 1 Nuclei template and 3 proofs of concept on GitHub.

All Synacor Zimbra Collaboration Suite vulnerabilities

Sources

Also known as GHSA-pj74-pf28-5qjw.