Hostname Canonicalization Vulnerability in Zimbra Collaboration Suite

CVE-2026-93630

What is CVE-2026-93630?

A hostname canonicalization vulnerability within Zimbra Collaboration Suite's email HTML sanitizers enables an unauthenticated sender to bypass restrictions on forms targeting the Zimbra host. The issue arises as crafted emails can contain percent-encoded hostnames that evade sanitization processes. Consequently, when a recipient interacts with such emails, a form can be submitted to the Zimbra origin, inadvertently utilizing their authentication cookies. Although the vulnerability itself does not compromise CSRF-token checks, it facilitates authenticated form requests under specific circumstances, demanding further vigilance from users and administrators of affected versions 10.1.16 and 10.1.21.

References