01 Record

CVE-2026-73572

In Zimbra Collaboration (ZCS) before 10.1.17, a stored cross-site scripting (XSS) vulnerability exists in the Zimbra Classic Web Client due to insufficient sanitization of specific attachment content

MediumPUBLISHEDCNA: mitre

Base score6.1 CVSS v3.xCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

View raw JSON CVE Program record

02 Description

In Zimbra Collaboration (ZCS) before 10.1.17, a stored cross-site scripting (XSS) vulnerability exists in the Zimbra Classic Web Client due to insufficient sanitization of specific attachment content

03 Metadata

Published: 2026-08-13 15:21Z1 DAY AGO
Last updated: 2026-08-13 15:57Z1 DAY AGO
Reserved: 2026-08-12
Assigning CNA: mitre
Record state: PUBLISHED
Severity: Medium (CVSS 6.1)
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Weaknesses: CWE-79
SSVC decision: ExploitationnoneAutomatablenoTechnical Impactpartial
Data version: 5.2
Document digest: 151a816a098983795ca1dae0f47fa3b5260c9e0a3895a4c1dc1b153f6161464b

04 Affected products

VendorProductVersionsPlatforms

ZimbraCollaboration0 to < 10.1.17—

05 References

wiki.zimbra.comhttps://wiki.zimbra.com/wiki/Zimbra_Security_Advisories
wiki.zimbra.comhttps://wiki.zimbra.com/wiki/Zimbra_Responsible_Disclosure_Policy