CVE-2022-27925

Zimbra Collaboration (aka ZCS) 8.8.15 and 9.0 has mboximport functionality that receives a ZIP...

7.2 HighIn KEVPublic exploit

Zimbra Collaboration (aka ZCS) 8.8.15 and 9.0 has mboximport functionality that receives a ZIP archive and extracts files from it. An authenticated user with administrator rights has the ability to upload arbitrary files to the system, leading to directory traversal.

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: Low
Privileges needed: High
User interaction: None

What an attacker can affect

Confidentiality: High
Integrity: High
Availability: High

Exploit likelihood

98.7%Up 97.8 points since Apr 21, 2022

What each source reports

NVD Score used 7.2

Record: CVE-2022-27925
CVSS 3.1: 7.2 HighCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
CVSS 2.0: 6.5 MediumAV:N/AC:L/Au:S/C:P/I:P/A:P
Weakness: CWE-22
Updated: 2026-11-02

CVE List 7.2

Record: CVE-2022-27925
CVSS 3.1: 7.2 HighCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Weakness: CWE-22
Updated: 2026-11-02

EUVDEUVD-2022-32413 7.2

Record: EUVD-2022-32413
CVSS 3.1: 7.2 HighCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

GitHub AdvisoriesGHSA-j5r7-6rm3-99mm 7.2

Zimbra Collaboration (aka ZCS) 8.8.15 and 9.0 has mboximport functionality that receives a ZIP...

Record: GHSA-j5r7-6rm3-99mm
CVSS 3.1: 7.2 HighCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Weakness: CWE-22, CWE-434
Updated: 2026-11-02

CISA KEV No score

Synacor Zimbra Collaboration Suite (ZCS) Arbitrary File Upload Vulnerability

Synacor Zimbra Collaboration Suite (ZCS) contains flaw in the mboximport functionality, allowing an authenticated attacker to upload arbitrary files to perform remote code execution. This vulnerability was chained with CVE-2022-37042 which allows for unauthenticated remote code execution.

Record: CVE-2022-27925
Weakness: CWE-22
Updated: 2026-11-02

OSV 7.2

Record: CVE-2022-27925
CVSS 3.1: 7.2 HighCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

Affected products

Public exploits

Links only. Every CVE stores no exploit code.

Public exploits
Source	Link	Date
Metasploit	Zip Path Traversal in Zimbra (mboximport) (CVE-2022-27925)	2022-05-10
PoC in GitHub	vnhacker1337/CVE-2022-27925-PoC	2022-08-12
PoC in GitHub	huahuatzt/CVE-2022-27925	2022-08-15
PoC in GitHub	miko550/CVE-2022-27925	2022-08-19
PoC in GitHub	Josexv1/CVE-2022-27925	2022-08-20
PoC in GitHub	navokus/CVE-2022-27925	2022-08-20
PoC in GitHub	Chocapikk/CVE-2022-27925-Revshell	2022-08-26
PoC in GitHub	akincibor/CVE-2022-27925	2022-09-12
PoC in GitHub	touchmycrazyredhat/CVE-2022-27925-Revshell	2022-09-17
PoC in GitHub	jam620/Zimbra	2022-09-25

Show 4 moreShow less

Public exploits
Source	Link	Date
PoC in GitHub	sh4den/CVE-2022-27925	2022-10-01
PoC in GitHub	onlyHerold22/CVE-2022-27925-PoC	2022-10-19
PoC in GitHub	sanan2004/CVE-2022-27925	2024-08-19
Nuclei	Zimbra Collaboration Suite 8.8.15/9.0 - Zip Path Traversal

History

History
Recorded	Changed	Sources
Nov 3, 2026	exploitation, exploits
Nov 2, 2026	first indexed	CVE List, EUVD, GitHub Advisories, CISA KEV, Metasploit, Nuclei, NVD, OSV, PoC in GitHub

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2022-27925 is a high vulnerability (CVSS 7.2) in Synacor Zimbra Collaboration Suite (zcs), published April 20, 2022. CISA lists it as known to be exploited, since August 11, 2022. EUVD reports exploitation since August 11, 2022. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 98.7%, the 99th percentile. No source names a fixed version.