{"id":"CVE-2025-27915","aliases":["EUVD-2025-7823","GHSA-5rg8-g76j-7fw7"],"status":"published","title":"An issue was discovered in Zimbra Collaboration (ZCS) 9.0 and 10.0 and 10.1. A stored cross-site...","description":"An issue was discovered in Zimbra Collaboration (ZCS) 9.0 and 10.0 and 10.1. A stored cross-site scripting (XSS) vulnerability exists in the Classic Web Client due to insufficient sanitization of HTML content in ICS files. When a user views an e-mail message containing a malicious ICS entry, its embedded JavaScript executes via an ontoggle event inside a \u003cdetails\u003e tag. This allows an attacker to run arbitrary JavaScript within the victim's session, potentially leading to unauthorized actions such as setting e-mail filters to redirect messages to an attacker-controlled address. As a result, an attacker can perform unauthorized actions on the victim's account, including e-mail redirection and data exfiltration.","severity":{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"adp","from":"cve"},"epss":{"day":"2026-11-12","score":0.04064,"percentile":0.9081,"model":"v2026.06.15"},"facts":{"in_kev":true,"known_exploited":true,"public_exploit":false,"fix_available":false},"cwes":["CWE-79"],"published":"2025-03-12T00:00:00Z","modified":"2026-10-28T10:58:53Z","kev":{"date_added":"2025-10-07","due_date":"2025-10-28","required_action":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","known_ransomware_use":"Unknown"},"exploitation":[{"source":"euvd","since":"2025-10-07"},{"source":"kev","since":"2025-10-07"}],"exploits":[{"source":"nuclei","id":"CVE-2025-27915","title":"Zimbra - Cross-Site Scripting via ICS Files","type":"detection template","url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-27915.yaml"}],"products":[{"vendor":"synacor","product":"zimbra collaboration suite (zcs)"},{"vendor":"synacor","product":"zimbra_collaboration_suite"}],"references":[{"url":"https://wiki.zimbra.com/wiki/Security_Center","tags":["Release Notes","web"]},{"url":"https://wiki.zimbra.com/wiki/Zimbra_Releases/10.1.5#Security_Fixes","tags":["Release Notes","web"]},{"url":"https://wiki.zimbra.com/wiki/Zimbra_Releases/10.0.13#Security_Fixes","tags":["Release Notes","web"]},{"url":"https://wiki.zimbra.com/wiki/Zimbra_Releases/9.0.0/P44#Security_Fixes","tags":["Release Notes","web"]},{"url":"https://strikeready.com/blog/0day-ics-attack-in-the-wild/","tags":["Exploit","Third Party Advisory","article"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-27915","tags":["US Government Resource","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-27915","tags":["advisory"]},{"url":"https://strikeready.com/blog/0day-ics-attack-in-the-wild"},{"url":"https://github.com/advisories/GHSA-5rg8-g76j-7fw7"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/27xxx/CVE-2025-27915.json","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2025-27915","description":"An issue was discovered in Zimbra Collaboration (ZCS) 9.0 and 10.0 and 10.1. A stored cross-site scripting (XSS) vulnerability exists in the Classic Web Client due to insufficient sanitization of HTML content in ICS files. When a user views an e-mail message containing a malicious ICS entry, its embedded JavaScript executes via an ontoggle event inside a \u003cdetails\u003e tag. This allows an attacker to run arbitrary JavaScript within the victim's session, potentially leading to unauthorized actions such as setting e-mail filters to redirect messages to an attacker-controlled address. As a result, an attacker can perform unauthorized actions on the victim's account, including e-mail redirection and data exfiltration.","status":"published","published":"2025-03-12T00:00:00Z","modified":"2026-02-26T19:09:35.78Z","cvss":[{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"adp"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:32:42.411662Z"}],"euvd":[{"id":"EUVD-2025-7823","description":"An issue was discovered in Zimbra Collaboration (ZCS) 9.0 and 10.0 and 10.1. A stored cross-site scripting (XSS) vulnerability exists in the Classic Web Client due to insufficient sanitization of HTML content in ICS files. When a user views an e-mail message containing a malicious ICS entry, its embedded JavaScript executes via an ontoggle event inside a \u003cdetails\u003e tag. This allows an attacker to run arbitrary JavaScript within the victim's session, potentially leading to unauthorized actions such as setting e-mail filters to redirect messages to an attacker-controlled address. As a result, an attacker can perform unauthorized actions on the victim's account, including e-mail redirection and data exfiltration.","status":"published","published":"2025-03-12T00:00:00Z","modified":"2026-02-26T19:09:35Z","cvss":[{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"exploited_since":"2025-10-07","updated_at":"2026-11-02T19:48:15.233808Z"}],"ghsa":[{"id":"GHSA-5rg8-g76j-7fw7","title":"An issue was discovered in Zimbra Collaboration (ZCS) 9.0 and 10.0 and 10.1. A stored cross-site...","description":"An issue was discovered in Zimbra Collaboration (ZCS) 9.0 and 10.0 and 10.1. A stored cross-site scripting (XSS) vulnerability exists in the Classic Web Client due to insufficient sanitization of HTML content in ICS files. When a user views an e-mail message containing a malicious ICS entry, its embedded JavaScript executes via an ontoggle event inside a \u003cdetails\u003e tag. This allows an attacker to run arbitrary JavaScript within the victim's session, potentially leading to unauthorized actions such as setting e-mail filters to redirect messages to an attacker-controlled address. As a result, an attacker can perform unauthorized actions on the victim's account, including e-mail redirection and data exfiltration.","status":"published","published":"2025-03-12T15:32:06Z","modified":"2025-10-22T00:33:16Z","cvss":[{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T15:04:08.198655Z"}],"kev":[{"id":"CVE-2025-27915","title":"Synacor Zimbra Collaboration Suite (ZCS) Cross-site Scripting Vulnerability","description":"Synacor Zimbra Collaboration Suite (ZCS) contains a cross-site scripting vulnerability that exists in the Classic Web Client due to insufficient sanitization of HTML content in ICS files. When a user views an e-mail message containing a malicious ICS entry, its embedded JavaScript executes via an ontoggle event inside a tag. This allows an attacker to run arbitrary JavaScript within the victim's session, potentially leading to unauthorized actions such as setting e-mail filters to redirect messages to an attacker-controlled address. As a result, an attacker can perform unauthorized actions on the victim's account, including e-mail redirection and data exfiltration.","cwes":["CWE-79"],"kev":{"date_added":"2025-10-07","due_date":"2025-10-28","required_action":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","known_ransomware_use":"Unknown"},"updated_at":"2026-11-02T17:00:15.999436Z"}],"nvd":[{"id":"CVE-2025-27915","description":"An issue was discovered in Zimbra Collaboration (ZCS) 9.0 and 10.0 and 10.1. A stored cross-site scripting (XSS) vulnerability exists in the Classic Web Client due to insufficient sanitization of HTML content in ICS files. When a user views an e-mail message containing a malicious ICS entry, its embedded JavaScript executes via an ontoggle event inside a \u003cdetails\u003e tag. This allows an attacker to run arbitrary JavaScript within the victim's session, potentially leading to unauthorized actions such as setting e-mail filters to redirect messages to an attacker-controlled address. As a result, an attacker can perform unauthorized actions on the victim's account, including e-mail redirection and data exfiltration.","status":"published","published":"2025-03-12T15:15:39.9Z","modified":"2026-06-17T09:04:22.957Z","cvss":[{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"secondary"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:10:53.93104Z"}],"osv":[{"id":"CVE-2025-27915","description":"An issue was discovered in Zimbra Collaboration (ZCS) 9.0 and 10.0 and 10.1. A stored cross-site scripting (XSS) vulnerability exists in the Classic Web Client due to insufficient sanitization of HTML content in ICS files. When a user views an e-mail message containing a malicious ICS entry, its embedded JavaScript executes via an ontoggle event inside a \u003cdetails\u003e tag. This allows an attacker to run arbitrary JavaScript within the victim's session, potentially leading to unauthorized actions such as setting e-mail filters to redirect messages to an attacker-controlled address. As a result, an attacker can perform unauthorized actions on the victim's account, including e-mail redirection and data exfiltration.","status":"published","published":"2025-03-12T00:00:00Z","modified":"2026-11-09T07:05:52.838645964Z","cvss":[{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-09T03:16:26.778234Z"}]}}