Stored XSS Vulnerability in Zimbra Collaboration by Zimbra
CVE-2025-66376

7.2HIGH

Key Information:

Vendor

Zimbra

Status
Collaboration
Vendor
CVE Published:
5 January 2026

What is CVE-2025-66376?

Zimbra Collaboration (ZCS) versions prior to 10.0.18 and 10.1.13 are susceptible to a stored Cross-Site Scripting (XSS) vulnerability. This flaw allows malicious actors to exploit Cascading Style Sheets (CSS) @import directives within HTML email messages. A successful exploit could lead to the execution of arbitrary scripts in the context of the victim's browser, compromising user data and security.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch

Affected Version(s)

Collaboration 10.0 < 10.0.18

Collaboration 10.1 < 10.1.13

References

https://wiki.zimbra.com/wiki/Zimbra_Security_Advisories
https://wiki.zimbra.com/wiki/Security_Center
https://wiki.zimbra.com/wiki/Zimbra_Responsible_Disclosur...

CVSS V3.1

Score:
7.2
Severity:
HIGH
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

JSON
.