CVE-2022-37042 Synacor Zimbra Collaboration Suite (ZCS) Authentication Bypass

Exploited in the wild Critical 9.8 Published 11 Aug 2022 Updated 4 Aug 2026

Attackers can bypass authentication to upload arbitrary files via mboximport, leading to directory traversal and remote code execution.

Exploited in the wild: Since 11 Aug 2022
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2022-37042?

CVE-2022-37042 is a critical path traversal vulnerability in Synacor Zimbra Collaboration Suite, published on 11 Aug 2022. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

Zimbra Collaboration Suite (ZCS) 8.8.15 and 9.0 has mboximport functionality that receives a ZIP archive and extracts files from it. By bypassing authentication (i.e., not having an authtoken), an attacker can upload arbitrary files to the system, leading to directory traversal and remote code execution. NOTE: this issue exists because of an incomplete fix for CVE-2022-27925.

Weakness: CWE-22

Which versions are affected by CVE-2022-37042?

It affects 1 product.

Products include Synacor Zimbra Collaboration Suite.

How do I fix CVE-2022-37042?

No fix has been published for CVE-2022-37042 yet. Limit exposure of the affected software until one is available. US federal agencies must fix it by 1 Sep 2022.

Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.

Is CVE-2022-37042 being exploited?

Yes. Attackers have exploited CVE-2022-37042 in the wild since at least 11 Aug 2022, including in ransomware campaigns.

Public exploit code: 1 Metasploit module, 1 Nuclei template and 3 proofs of concept on GitHub.

All Synacor Zimbra Collaboration Suite vulnerabilities

Sources

Also known as GHSA-9g5r-3vrr-xfcm.