CVE-2026-73574
LowCVSS 3.1Summary
In Zimbra Collaboration before 10.1.17, a local file inclusion (LFI) vulnerability exists in the Zimbra Classic Web Client due to improper validation of the fu request parameter. An unauthenticated attacker can exploit this vulnerability by supplying a crafted path, potentially allowing unauthorized disclosure of protected files, such as WEB-INF/web.xml, within the web application directory. This occurs in the Forward servlet.
Risk Assessment
The risk includes disclosure of sensitive configuration files and other data, which can lead to privilege escalation or further attacks. An unauthenticated attacker can gain access to internal system information.
Recommendation
It is recommended to immediately upgrade Zimbra Collaboration to version 10.1.17 or later. Also thoroughly validate input parameters and restrict access to the Forward servlet.
Original NVD description (English source)
In Zimbra Collaboration before 10.1.17, a local file inclusion (LFI) vulnerability exists in the Zimbra Classic Web Client due to improper validation of the fu request parameter. An unauthenticated attacker can exploit this vulnerability by supplying a crafted path, potentially allowing unauthorized disclosure of protected files, such as WEB-INF/web.xml, within the web application directory. This occurs in the Forward servlet.