CVE-2022-27925 Synacor Zimbra Collaboration Suite (ZCS) Arbitrary File Upload

Exploited in the wild High 7.2 Published 20 Apr 2022 Updated 1 Oct 2026

An authenticated administrator can exploit directory traversal in mboximport to upload arbitrary files, potentially leading to code execution.

Exploited in the wild: Since 11 Aug 2022
Login needed: An administrator
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2022-27925?

CVE-2022-27925 is a high-severity path traversal vulnerability in Synacor Zimbra Collaboration Suite, published on 20 Apr 2022. An attacker needs administrator access to exploit it, with no action from the victim.

Official description

Zimbra Collaboration (aka ZCS) 8.8.15 and 9.0 has mboximport functionality that receives a ZIP archive and extracts files from it. An authenticated user with administrator rights has the ability to upload arbitrary files to the system, leading to directory traversal.

Weakness: CWE-22

Which versions are affected by CVE-2022-27925?

It affects 1 product.

Products include Synacor Zimbra Collaboration Suite.

How do I fix CVE-2022-27925?

No fix has been published for CVE-2022-27925 yet. Limit exposure of the affected software until one is available. US federal agencies must fix it by 1 Sep 2022.

Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.

Is CVE-2022-27925 being exploited?

Yes. Attackers have exploited CVE-2022-27925 in the wild since at least 11 Aug 2022, including in ransomware campaigns.

Public exploit code: 1 Metasploit module, 1 Nuclei template and 12 proofs of concept on GitHub.

All Synacor Zimbra Collaboration Suite vulnerabilities

Sources

Also known as GHSA-j5r7-6rm3-99mm.