CVE-2026-93633 Zimbra Collaboration Suite Briefcase CSS Sanitization Bypass via Non-ASCII Stylesheet Characters

Medium 5.4 Published 23 Oct 2026 Updated 28 Oct 2026

Exploited in the wild: Not known
Fix: None listed

What is CVE-2026-93633?

CVE-2026-93633 is a medium-severity vulnerability in Synacor Zimbra Collaboration Suite, published on 23 Oct 2026.

Official description

A CSS sanitization vulnerability in Zimbra Collaboration Suite (ZCS) allows an authenticated user with Briefcase access to publish a document that displays attacker-controlled content under the Zimbra origin. When processing a stylesheet containing non-ASCII characters, DefangFilter appends the final ASCII segment without sanitizing it. HTML stored as application/x-zimbra-doc can therefore retain CSS URL references that the normal sanitizer removes. An attacker can share a crafted document that loads external resources and displays a credential-collection form using Zimbra's own visual assets. Exploitation requires the victim to open the document in a browser that renders the content type inline; credential theft additionally requires form submission. ZCS 10.1.16 and 10.1.20 are affected.

Weakness: CWE-79

Which versions are affected by CVE-2026-93633?

It affects 1 product.

Products include Synacor Zimbra Collaboration Suite.

How do I fix CVE-2026-93633?

No fix has been published for CVE-2026-93633 yet. Limit exposure of the affected software until one is available.

Is CVE-2026-93633 being exploited?

There is no known exploitation of CVE-2026-93633 in the wild and no public exploit code.

All Synacor Zimbra Collaboration Suite vulnerabilities

Sources

Also known as GHSA-x7vx-vqqq-6frh.