{"id":"CVE-2022-41352","aliases":["EUVD-2022-44557","GHSA-85q4-vgvj-3q28"],"status":"published","title":"An issue was discovered in Zimbra Collaboration (ZCS) 8.8.15 and 9.0. An attacker can upload...","description":"An issue was discovered in Zimbra Collaboration (ZCS) 8.8.15 and 9.0. An attacker can upload arbitrary files through amavis via a cpio loophole (extraction to /opt/zimbra/jetty/webapps/zimbra/public) that can lead to incorrect access to any other user accounts. Zimbra recommends pax over cpio. Also, pax is in the prerequisites of Zimbra on Ubuntu; however, pax is no longer part of a default Red Hat installation after RHEL 6 (or CentOS 6). Once pax is installed, amavis automatically prefers it over cpio.","severity":{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.95478,"percentile":0.9987,"model":"v2026.06.15"},"facts":{"in_kev":true,"known_exploited":true,"public_exploit":true,"fix_available":false},"cwes":["CWE-22","CWE-434"],"published":"2022-09-26T00:00:00Z","modified":"2026-10-28T02:30:51Z","kev":{"date_added":"2022-10-20","due_date":"2022-11-10","required_action":"Apply updates per vendor instructions.","known_ransomware_use":"Known"},"exploitation":[{"source":"euvd","since":"2022-10-20"},{"source":"kev","since":"2022-10-20"}],"exploits":[{"source":"metasploit","id":"exploit/linux/http/zimbra_cpio_cve_2022_41352","title":"TAR Path Traversal in Zimbra (CVE-2022-41352)","type":"exploit","platform":"Linux","date":"2022-06-28","verified":true,"url":"https://www.rapid7.com/db/modules/exploit/linux/http/zimbra_cpio_cve_2022_41352"},{"source":"pocgithub","id":"segfault-it/cve-2022-41352","title":"segfault-it/cve-2022-41352","date":"2022-10-10","url":"https://github.com/segfault-it/cve-2022-41352"},{"source":"pocgithub","id":"Cr4ckC4t/cve-2022-41352-zimbra-rce","title":"Cr4ckC4t/cve-2022-41352-zimbra-rce","date":"2022-11-11","url":"https://github.com/Cr4ckC4t/cve-2022-41352-zimbra-rce"},{"source":"pocgithub","id":"dafrax/cve-2022-41352-zimbra-rce","title":"dafrax/cve-2022-41352-zimbra-rce","date":"2023-12-10","url":"https://github.com/dafrax/cve-2022-41352-zimbra-rce"},{"source":"nuclei","id":"CVE-2022-41352","title":"Zimbra Collaboration - Unrestricted File Upload","type":"detection template","url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-41352.yaml"}],"products":[{"vendor":"synacor","product":"zimbra collaboration suite (zcs)"},{"vendor":"synacor","product":"zimbra_collaboration_suite"}],"references":[{"url":"https://wiki.zimbra.com/wiki/Zimbra_Security_Advisories","tags":["x_transferred","Vendor Advisory","web"]},{"url":"https://wiki.zimbra.com/wiki/Security_Center","tags":["x_transferred","Patch","Release Notes","Vendor Advisory","web"]},{"url":"https://forums.zimbra.org/viewtopic.php?t=71153\u0026p=306532","tags":["x_transferred","Mitigation","Vendor Advisory","web"]},{"url":"http://packetstormsecurity.com/files/169458/Zimbra-Collaboration-Suite-TAR-Path-Traversal.html","tags":["x_transferred","Exploit","Third Party Advisory","VDB Entry","web"]},{"url":"https://www.secpod.com/blog/unpatched-rce-bug-in-zimbra-collaboration-suite-exploited-in-wild/","tags":["x_transferred","Third Party Advisory","article"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2022-41352","tags":["government-resource","US Government Resource","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-41352","tags":["advisory"]},{"url":"https://www.secpod.com/blog/unpatched-rce-bug-in-zimbra-collaboration-suite-exploited-in-wild"},{"url":"https://github.com/advisories/GHSA-85q4-vgvj-3q28"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/41xxx/CVE-2022-41352.json","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2022-41352","description":"An issue was discovered in Zimbra Collaboration (ZCS) 8.8.15 and 9.0. An attacker can upload arbitrary files through amavis via a cpio loophole (extraction to /opt/zimbra/jetty/webapps/zimbra/public) that can lead to incorrect access to any other user accounts. Zimbra recommends pax over cpio. Also, pax is in the prerequisites of Zimbra on Ubuntu; however, pax is no longer part of a default Red Hat installation after RHEL 6 (or CentOS 6). Once pax is installed, amavis automatically prefers it over cpio.","status":"published","published":"2022-09-26T00:00:00Z","modified":"2026-09-10T03:55:18.761Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"adp"}],"cwes":["CWE-22"],"updated_at":"2026-11-02T14:34:28.038197Z"}],"euvd":[{"id":"EUVD-2022-44557","description":"An issue was discovered in Zimbra Collaboration (ZCS) 8.8.15 and 9.0. An attacker can upload arbitrary files through amavis via a cpio loophole (extraction to /opt/zimbra/jetty/webapps/zimbra/public) that can lead to incorrect access to any other user accounts. Zimbra recommends pax over cpio. Also, pax is in the prerequisites of Zimbra on Ubuntu; however, pax is no longer part of a default Red Hat installation after RHEL 6 (or CentOS 6). Once pax is installed, amavis automatically prefers it over cpio.","status":"published","published":"2022-09-26T00:00:00Z","modified":"2026-09-10T03:55:18Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"exploited_since":"2022-10-20","updated_at":"2026-11-02T17:28:25.986684Z"}],"ghsa":[{"id":"GHSA-85q4-vgvj-3q28","title":"An issue was discovered in Zimbra Collaboration (ZCS) 8.8.15 and 9.0. An attacker can upload...","description":"An issue was discovered in Zimbra Collaboration (ZCS) 8.8.15 and 9.0. An attacker can upload arbitrary files through amavisd via a cpio loophole (extraction to /opt/zimbra/jetty/webapps/zimbra/public) that can lead to incorrect access to any other user accounts. Zimbra recommends pax over cpio. Also, pax is in the prerequisites of Zimbra on Ubuntu; however, pax is no longer part of a default Red Hat installation after RHEL 6 (or CentOS 6). Once pax is installed, amavisd automatically prefers it over cpio.","status":"published","published":"2022-09-27T00:00:23Z","modified":"2025-10-22T00:32:37Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-22","CWE-434"],"updated_at":"2026-11-02T15:04:05.954742Z"}],"kev":[{"id":"CVE-2022-41352","title":"Synacor Zimbra Collaboration Suite (ZCS) Arbitrary File Upload Vulnerability","description":"Synacor Zimbra Collaboration Suite (ZCS) allows an attacker to upload arbitrary files using cpio package to gain incorrect access to any other user accounts.","cwes":["CWE-22"],"kev":{"date_added":"2022-10-20","due_date":"2022-11-10","required_action":"Apply updates per vendor instructions.","known_ransomware_use":"Known"},"updated_at":"2026-11-02T17:00:16.234141Z"}],"nvd":[{"id":"CVE-2022-41352","description":"An issue was discovered in Zimbra Collaboration (ZCS) 8.8.15 and 9.0. An attacker can upload arbitrary files through amavis via a cpio loophole (extraction to /opt/zimbra/jetty/webapps/zimbra/public) that can lead to incorrect access to any other user accounts. Zimbra recommends pax over cpio. Also, pax is in the prerequisites of Zimbra on Ubuntu; however, pax is no longer part of a default Red Hat installation after RHEL 6 (or CentOS 6). Once pax is installed, amavis automatically prefers it over cpio.","status":"published","published":"2022-09-26T02:15:10.733Z","modified":"2026-09-10T04:17:37.41Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary"},{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"secondary"}],"cwes":["CWE-22"],"updated_at":"2026-11-02T14:07:28.501364Z"}],"osv":[{"id":"CVE-2022-41352","description":"An issue was discovered in Zimbra Collaboration (ZCS) 8.8.15 and 9.0. An attacker can upload arbitrary files through amavis via a cpio loophole (extraction to /opt/zimbra/jetty/webapps/zimbra/public) that can lead to incorrect access to any other user accounts. Zimbra recommends pax over cpio. Also, pax is in the prerequisites of Zimbra on Ubuntu; however, pax is no longer part of a default Red Hat installation after RHEL 6 (or CentOS 6). Once pax is installed, amavis automatically prefers it over cpio.","status":"published","published":"2022-09-26T00:00:00Z","modified":"2026-10-28T02:30:51.59110152Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:44:26.860704Z"}]}}