{"id":"CVE-2026-93643","aliases":["EUVD-2026-87101","GHSA-4g2j-34p9-p684"],"status":"published","title":"Zimbra Collaboration Suite OnlyOffice Integration Path Traversal Leading to Remote Code Execution via Unauthenticated /downloadas Request","description":"When OnlyOffice/Document Editing is available, an unauthenticated remote attacker with access to an existing supported public Briefcase document can abuse unsigned save fields to perform path-traversal writes and execute commands as zimbra.","severity":{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.0096,"percentile":0.61762,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-22","CWE-863"],"published":"2026-09-25T13:57:19Z","modified":"2026-09-29T21:29:07Z","products":[{"vendor":"synacor","product":"zimbra collaboration suite (zcs)"},{"vendor":"zimbra","product":"zimbra collaboration suite (zcs)"}],"references":[{"url":"https://wiki.zimbra.com/wiki/Zimbra_Security_Advisories","tags":["vendor-advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-93643"},{"url":"https://github.com/advisories/GHSA-4g2j-34p9-p684"}],"sources":{"cve":[{"id":"CVE-2026-93643","title":"Zimbra Collaboration Suite OnlyOffice Integration Path Traversal Leading to Remote Code Execution via Unauthenticated /downloadas Request","description":"When OnlyOffice/Document Editing is available, an unauthenticated remote attacker with access to an existing supported public Briefcase document can abuse unsigned save fields to perform path-traversal writes and execute commands as zimbra.","status":"published","published":"2026-09-25T13:57:19.199Z","modified":"2026-09-26T03:55:49.487Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"cna"}],"cwes":["CWE-22","CWE-863"],"updated_at":"2026-11-02T14:19:54.50686Z"}],"euvd":[{"id":"EUVD-2026-87101","description":"When OnlyOffice/Document Editing is available, an unauthenticated remote attacker with access to an existing supported public Briefcase document can abuse unsigned save fields to perform path-traversal writes and execute commands as zimbra.","status":"published","published":"2026-09-25T13:57:19Z","modified":"2026-09-26T03:55:49Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T17:27:54.622662Z"}],"ghsa":[{"id":"GHSA-4g2j-34p9-p684","title":"When OnlyOffice/Document Editing is available, an unauthenticated remote attacker with access to...","description":"When OnlyOffice/Document Editing is available, an unauthenticated remote attacker with access to an existing supported public Briefcase document can abuse unsigned save fields to perform path-traversal writes and execute commands as zimbra.","status":"published","published":"2026-09-25T15:31:48Z","modified":"2026-09-25T15:31:49Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-22"],"updated_at":"2026-11-02T15:12:27.190195Z"}],"nvd":[{"id":"CVE-2026-93643","description":"When OnlyOffice/Document Editing is available, an unauthenticated remote attacker with access to an existing supported public Briefcase document can abuse unsigned save fields to perform path-traversal writes and execute commands as zimbra.","status":"published","published":"2026-09-25T14:17:23.55Z","modified":"2026-09-29T21:29:07.663Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"secondary"}],"cwes":["CWE-22","CWE-863"],"updated_at":"2026-11-02T14:12:51.721923Z"}]}}