medium·Product Based Web Vulnerabilities·Updated Dec 30, 2025

Zimbra Collaboration - Local File Inclusion

Est. Time~10 seconds

Scan TypeGroup Scan

Targetsurl

CostFree

Times Used

continuous scan runs

Continuously Checked

assets under CS

Vulnerabilities Found

confirmed findings

References

github.com↗

🔴

CISA Known Exploited Vulnerability

This CVE is actively exploited in the wild. CISA mandates federal agencies to patch immediately.

CVECVE-2025-68645

8.8

CVSShigh

Exploitable remotely over the internet · no authentication required · user interaction needed.

Description

A Local File Inclusion (LFI) vulnerability exists in the Webmail Classic UI of Zimbra Collaboration (ZCS) 10.0 and 10.1 because of improper handling of user-supplied request parameters in the RestFilter servlet. An unauthenticated remote attacker can craft requests to the /h/rest endpoint to influence internal request dispatching, allowing inclusion of arbitrary files from the WebRoot directory.

Attack Vector

Network

Privileges Req.

None

User Interaction

Required

Affected

n/aby n/a

n/a

Updated Nov 10, 2026View on NVD →

Similar Tools

Check your infrastructure.
Right now.

12,000+ scanners. Free to start. No credit card required.

Zimbra Collaboration - Local File Inclusion

Check your infrastructure.Right now.

Check your infrastructure.
Right now.