XSS in Synacor Zimbra Collaboration Suite
CVE-2026-33370
An issue was discovered in Zimbra Collaboration (ZCS) 10.0 and 10.1. A stored cross-site scripting (XSS) vulnerability exists in the Zimbra Briefcase feature due to insufficient sanitization of specific uploaded file types. When a user opens a publicly shared Briefcase file containing malicious scripts, the embedded JavaScript executes in the context of the user's session. This allows an attacker to run arbitrary scripts, potentially leading to data exfiltration or other unauthorized actions on behalf of the victim user.
Vulnerability class: XSS (Cross-Site Scripting)
EPSS: 0.002 (10.8th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 6.1 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N.
Affected products
- Synacor Zimbra_collaboration_suite
- N/a — versions n/a
Weakness classification (CWE)
References
- cve@mitre.org (Vendor Advisory)
- cve@mitre.org (Release Notes, Vendor Advisory)
- cve@mitre.org (Product)
- cve@mitre.org (Release Notes)
Frequently asked questions
- What is CVE-2026-33370?
- CVE-2026-33370 is a medium-severity vulnerability in Synacor Zimbra Collaboration Suite, classified under Cross-site Scripting. CVSS score: 6.1/10. Published 2026-03-20.
- How severe is CVE-2026-33370?
- Medium severity. CVSS v3 base score is 6.1 out of 10.