medium·Product Based Web Vulnerabilities·Updated Dec 30, 2025

Zimbra Collaboration - Local File Inclusion

Run This Scanner →

Est. Time~10 seconds

Scan TypeGroup Scan

Targetsurl

CostFree

2.4k

Times Used

continuous scan runs

Continuously Checked

assets under CS

Vulnerabilities Found

confirmed findings

References

github.com↗

🔴

CISA Known Exploited Vulnerability

This CVE is actively exploited in the wild. CISA mandates federal agencies to patch immediately.

CVECVE-2025-68645

8.8

CVSShigh

Exploitable remotely over the internet · no authentication required · user interaction needed.

A Local File Inclusion (LFI) vulnerability exists in the Webmail Classic UI of Zimbra Collaboration (ZCS) 10.0 and 10.1 because of improper handling of user-supplied request parameters in the RestFilter servlet. An unauthenticated remote attacker can craft requests to the /h/rest endpoint to influence internal request dispatching, allowing inclusion of arbitrary files from the WebRoot directory.

Attack Vector

Network

Privileges Req.

None

User Interaction

Required

Affected

n/aby n/a

n/a

Updated Sep 9, 2026View on NVD →

Similar Tools

Check your infrastructure.
Right now.

11,000+ scanners. Free to start. No credit card required.

Run This Scanner →Browse All Tools

Zimbra Collaboration - Local File Inclusion

Check your infrastructure.Right now.

Check your infrastructure.
Right now.