CVE-2022-41352 Synacor Zimbra Collaboration Suite (ZCS) Arbitrary File Upload

Exploited in the wild Critical 9.8 Published 26 Sep 2022 Updated 10 Sep 2026

Attackers can upload arbitrary files via a cpio loophole in Zimbra, potentially accessing other user accounts unless pax is installed.

Exploited in the wild: Since 20 Oct 2022
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2022-41352?

CVE-2022-41352 is a critical path traversal vulnerability in Synacor Zimbra Collaboration Suite, published on 26 Sep 2022. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

An issue was discovered in Zimbra Collaboration (ZCS) 8.8.15 and 9.0. An attacker can upload arbitrary files through amavis via a cpio loophole (extraction to /opt/zimbra/jetty/webapps/zimbra/public) that can lead to incorrect access to any other user accounts. Zimbra recommends pax over cpio. Also, pax is in the prerequisites of Zimbra on Ubuntu; however, pax is no longer part of a default Red Hat installation after RHEL 6 (or CentOS 6). Once pax is installed, amavis automatically prefers it over cpio.

Weakness: CWE-22

Which versions are affected by CVE-2022-41352?

It affects 1 product.

Products include Synacor Zimbra Collaboration Suite.

How do I fix CVE-2022-41352?

No fix has been published for CVE-2022-41352 yet. Limit exposure of the affected software until one is available. US federal agencies must fix it by 10 Nov 2022.

Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.

Is CVE-2022-41352 being exploited?

Yes. Attackers have exploited CVE-2022-41352 in the wild since at least 20 Oct 2022, including in ransomware campaigns.

Public exploit code: 1 Metasploit module, 1 Nuclei template and 3 proofs of concept on GitHub.

All Synacor Zimbra Collaboration Suite vulnerabilities

Sources

Also known as GHSA-85q4-vgvj-3q28.