CVE-2022-37042

Zimbra Collaboration Suite (ZCS) 8.8.15 and 9.0 has mboximport functionality that receives a ZIP...

9.8 CriticalIn KEVPublic exploit

Zimbra Collaboration Suite (ZCS) 8.8.15 and 9.0 has mboximport functionality that receives a ZIP archive and extracts files from it. By bypassing authentication (i.e., not having an authtoken), an attacker can upload arbitrary files to the system, leading to directory traversal and remote code execution. NOTE: this issue exists because of an incomplete fix for CVE-2022-27925.

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: Low
Privileges needed: None
User interaction: None

What an attacker can affect

Confidentiality: High
Integrity: High
Availability: High

Exploit likelihood

92.1%Up 88.1 points since Aug 12, 2022

What each source reports

NVD Score used 9.8

Record: CVE-2022-37042
CVSS 3.1: 9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness: CWE-22
Updated: 2026-11-02

CVE List 9.8

Record: CVE-2022-37042
CVSS 3.1: 9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness: CWE-22
Updated: 2026-11-02

EUVDEUVD-2022-39696 9.8

Record: EUVD-2022-39696
CVSS 3.1: 9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

GitHub AdvisoriesGHSA-9g5r-3vrr-xfcm 9.8

Zimbra Collaboration Suite (ZCS) 8.8.15 and 9.0 has mboximport functionality that receives a ZIP...

Record: GHSA-9g5r-3vrr-xfcm
CVSS 3.1: 9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness: CWE-22, CWE-287
Updated: 2026-11-02

CISA KEV No score

Synacor Zimbra Collaboration Suite (ZCS) Authentication Bypass Vulnerability

Synacor Zimbra Collaboration Suite (ZCS) contains an authentication bypass vulnerability in MailboxImportServlet. This vulnerability was chained with CVE-2022-27925 which allows for unauthenticated remote code execution.

Record: CVE-2022-37042
Weakness: CWE-23
Updated: 2026-11-02

OSV 9.8

Record: CVE-2022-37042
CVSS 3.1: 9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

Affected products

Public exploits

Links only. Every CVE stores no exploit code.

Public exploits
Source	Link	Date
Metasploit	Zip Path Traversal in Zimbra (mboximport) (CVE-2022-27925)	2022-05-10
PoC in GitHub	GreyNoise-Intelligence/Zimbra_CVE-2022-37042-_CVE-2022-27925	2022-08-18
PoC in GitHub	aels/CVE-2022-37042	2022-08-25
PoC in GitHub	0xf4n9x/CVE-2022-37042	2022-10-24
Nuclei	Zimbra Collaboration Suite 8.8.15/9.0 - Remote Code Execution

History

History
Recorded	Changed	Sources
Nov 3, 2026	exploitation, exploits
Nov 2, 2026	first indexed	CVE List, EUVD, GitHub Advisories, CISA KEV, Metasploit, Nuclei, NVD, OSV, PoC in GitHub

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2022-37042 is a critical vulnerability (CVSS 9.8) in Synacor Zimbra Collaboration Suite (zcs), published August 11, 2022. CISA lists it as known to be exploited, since August 11, 2022. EUVD reports exploitation since August 11, 2022. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 92.1%, the 99th percentile. No source names a fixed version.