CSS Sanitization Vulnerability in Zimbra Collaboration Suite
CVE-2026-93633

5.4MEDIUM

Key Information:

Vendor

Zimbra

Status
Zimbra Collaboration Suite
Vendor
CVE Published:
23 October 2026

What is CVE-2026-93633?

A CSS sanitization vulnerability in the Zimbra Collaboration Suite (ZCS) enables an authenticated user with Briefcase access to publish documents that may display attacker-controlled content. This occurs when the DefangFilter processes stylesheets containing non-ASCII characters, leading to a failure to properly sanitize these stylesheets. As a result, malicious HTML stored as application/x-zimbra-doc can retain harmful CSS URL references. Attackers can exploit this vulnerability by sharing crafted documents that prompt credential collection forms, leveraging Zimbra's visual assets. Successful exploitation requires the victim to view the document in a browser that renders the content inline, with additional steps needed for the theft of credentials through form submission.

Affected Version(s)

Zimbra Collaboration Suite 0 <= 10.1.20

References

https://wiki.zimbra.com/wiki/Zimbra_Security_Advisories
vendor-advisory
https://www.rapid7.com/blog/post/ve-breaking-zimbra-ident...
related

CVSS V3.1

Score:
5.4
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Jonah Burgess (CryptoCat), Senior Security Researcher, Rapid7
.