{"id":"CVE-2022-27925","aliases":["EUVD-2022-32413","GHSA-j5r7-6rm3-99mm"],"status":"published","title":"Zimbra Collaboration (aka ZCS) 8.8.15 and 9.0 has mboximport functionality that receives a ZIP...","description":"Zimbra Collaboration (aka ZCS) 8.8.15 and 9.0 has mboximport functionality that receives a ZIP archive and extracts files from it. An authenticated user with administrator rights has the ability to upload arbitrary files to the system, leading to directory traversal.","severity":{"version":"3.1","score":7.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-11","score":0.98676,"percentile":0.99924,"model":"v2026.06.15"},"facts":{"in_kev":true,"known_exploited":true,"public_exploit":true,"fix_available":false},"cwes":["CWE-22","CWE-434"],"published":"2022-04-20T23:23:25Z","modified":"2026-10-28T02:30:53Z","kev":{"date_added":"2022-08-11","due_date":"2022-09-01","required_action":"Apply updates per vendor instructions.","known_ransomware_use":"Known"},"exploitation":[{"source":"euvd","since":"2022-08-11"},{"source":"kev","since":"2022-08-11"}],"exploits":[{"source":"metasploit","id":"exploit/linux/http/zimbra_mboximport_cve_2022_27925","title":"Zip Path Traversal in Zimbra (mboximport) (CVE-2022-27925)","type":"exploit","platform":"Linux","date":"2022-05-10","verified":true,"url":"https://www.rapid7.com/db/modules/exploit/linux/http/zimbra_mboximport_cve_2022_27925"},{"source":"pocgithub","id":"vnhacker1337/CVE-2022-27925-PoC","title":"vnhacker1337/CVE-2022-27925-PoC","date":"2022-08-12","url":"https://github.com/vnhacker1337/CVE-2022-27925-PoC"},{"source":"pocgithub","id":"huahuatzt/CVE-2022-27925","title":"huahuatzt/CVE-2022-27925","date":"2022-08-15","url":"https://github.com/huahuatzt/CVE-2022-27925"},{"source":"pocgithub","id":"miko550/CVE-2022-27925","title":"miko550/CVE-2022-27925","date":"2022-08-19","url":"https://github.com/miko550/CVE-2022-27925"},{"source":"pocgithub","id":"Josexv1/CVE-2022-27925","title":"Josexv1/CVE-2022-27925","date":"2022-08-20","url":"https://github.com/Josexv1/CVE-2022-27925"},{"source":"pocgithub","id":"navokus/CVE-2022-27925","title":"navokus/CVE-2022-27925","date":"2022-08-20","url":"https://github.com/navokus/CVE-2022-27925"},{"source":"pocgithub","id":"Chocapikk/CVE-2022-27925-Revshell","title":"Chocapikk/CVE-2022-27925-Revshell","date":"2022-08-26","url":"https://github.com/Chocapikk/CVE-2022-27925-Revshell"},{"source":"pocgithub","id":"akincibor/CVE-2022-27925","title":"akincibor/CVE-2022-27925","date":"2022-09-12","url":"https://github.com/akincibor/CVE-2022-27925"},{"source":"pocgithub","id":"touchmycrazyredhat/CVE-2022-27925-Revshell","title":"touchmycrazyredhat/CVE-2022-27925-Revshell","date":"2022-09-17","url":"https://github.com/touchmycrazyredhat/CVE-2022-27925-Revshell"},{"source":"pocgithub","id":"jam620/Zimbra","title":"jam620/Zimbra","date":"2022-09-25","url":"https://github.com/jam620/Zimbra"},{"source":"pocgithub","id":"sh4den/CVE-2022-27925","title":"sh4den/CVE-2022-27925","date":"2022-10-01","url":"https://github.com/sh4den/CVE-2022-27925"},{"source":"pocgithub","id":"onlyHerold22/CVE-2022-27925-PoC","title":"onlyHerold22/CVE-2022-27925-PoC","date":"2022-10-19","url":"https://github.com/onlyHerold22/CVE-2022-27925-PoC"},{"source":"pocgithub","id":"sanan2004/CVE-2022-27925","title":"sanan2004/CVE-2022-27925","date":"2024-08-19","url":"https://github.com/sanan2004/CVE-2022-27925"},{"source":"nuclei","id":"CVE-2022-27925","title":"Zimbra Collaboration Suite 8.8.15/9.0 - Zip Path Traversal","type":"detection template","url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-27925.yaml"}],"products":[{"vendor":"synacor","product":"zimbra collaboration suite (zcs)"},{"vendor":"synacor","product":"zimbra_collaboration_suite"}],"references":[{"url":"https://wiki.zimbra.com/wiki/Zimbra_Security_Advisories","tags":["x_refsource_MISC","x_transferred","Vendor Advisory","web"]},{"url":"https://wiki.zimbra.com/wiki/Security_Center","tags":["x_refsource_MISC","x_transferred","Vendor Advisory","web"]},{"url":"https://wiki.zimbra.com/wiki/Zimbra_Releases/9.0.0/P24","tags":["x_refsource_MISC","x_transferred","Release Notes","Vendor Advisory","web"]},{"url":"http://packetstormsecurity.com/files/168146/Zimbra-Zip-Path-Traversal.html","tags":["x_refsource_MISC","x_transferred","Exploit","Third Party Advisory","VDB Entry","web"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2022-27925","tags":["government-resource","US Government Resource","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-27925","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-j5r7-6rm3-99mm"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/27xxx/CVE-2022-27925.json","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2022-27925","description":"Zimbra Collaboration (aka ZCS) 8.8.15 and 9.0 has mboximport functionality that receives a ZIP archive and extracts files from it. An authenticated user with administrator rights has the ability to upload arbitrary files to the system, leading to directory traversal.","status":"published","published":"2022-04-20T23:23:25Z","modified":"2026-10-01T18:35:21.588Z","cvss":[{"version":"3.1","score":7.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"adp"}],"cwes":["CWE-22"],"updated_at":"2026-11-02T14:34:33.913527Z"}],"euvd":[{"id":"EUVD-2022-32413","description":"Zimbra Collaboration (aka ZCS) 8.8.15 and 9.0 has mboximport functionality that receives a ZIP archive and extracts files from it. An authenticated user with administrator rights has the ability to upload arbitrary files to the system, leading to directory traversal.","status":"published","published":"2022-04-20T23:23:25Z","modified":"2026-10-01T18:35:21Z","cvss":[{"version":"3.1","score":7.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"exploited_since":"2022-08-11","updated_at":"2026-11-02T17:27:43.966642Z"}],"ghsa":[{"id":"GHSA-j5r7-6rm3-99mm","title":"Zimbra Collaboration (aka ZCS) 8.8.15 and 9.0 has mboximport functionality that receives a ZIP...","description":"Zimbra Collaboration (aka ZCS) 8.8.15 and 9.0 has mboximport functionality that receives a ZIP archive and extracts files from it. An authenticated user with administrator rights has the ability to upload arbitrary files to the system, leading to directory traversal.","status":"published","published":"2022-04-22T00:00:38Z","modified":"2025-10-22T00:33:36Z","cvss":[{"version":"3.1","score":7.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-22","CWE-434"],"updated_at":"2026-11-02T15:04:08.198655Z"}],"kev":[{"id":"CVE-2022-27925","title":"Synacor Zimbra Collaboration Suite (ZCS) Arbitrary File Upload Vulnerability","description":"Synacor Zimbra Collaboration Suite (ZCS) contains flaw in the mboximport functionality, allowing an authenticated attacker to upload arbitrary files to perform remote code execution. This vulnerability was chained with CVE-2022-37042 which allows for unauthenticated remote code execution.","cwes":["CWE-22"],"kev":{"date_added":"2022-08-11","due_date":"2022-09-01","required_action":"Apply updates per vendor instructions.","known_ransomware_use":"Known"},"updated_at":"2026-11-02T17:00:16.234141Z"}],"nvd":[{"id":"CVE-2022-27925","description":"Zimbra Collaboration (aka ZCS) 8.8.15 and 9.0 has mboximport functionality that receives a ZIP archive and extracts files from it. An authenticated user with administrator rights has the ability to upload arbitrary files to the system, leading to directory traversal.","status":"published","published":"2022-04-21T00:15:08.407Z","modified":"2026-10-01T19:17:14.417Z","cvss":[{"version":"3.1","score":7.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"primary"},{"version":"3.1","score":7.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"secondary"},{"version":"2.0","score":6.5,"vector":"AV:N/AC:L/Au:S/C:P/I:P/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-22"],"updated_at":"2026-11-02T14:07:16.9948Z"}],"osv":[{"id":"CVE-2022-27925","description":"Zimbra Collaboration (aka ZCS) 8.8.15 and 9.0 has mboximport functionality that receives a ZIP archive and extracts files from it. An authenticated user with administrator rights has the ability to upload arbitrary files to the system, leading to directory traversal.","status":"published","published":"2022-04-20T23:23:25Z","modified":"2026-10-28T02:30:53.5959164Z","cvss":[{"version":"3.1","score":7.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:44:24.758293Z"}]}}