CVE-2026-73572

Name of the Vulnerable Software and Affected Versions Zimbra Collaboration (ZCS) versions prior to 10.1.17

Description A stored cross-site scripting (XSS) issue exists in the Zimbra Classic Web Client. This occurs because the system does not sufficiently sanitize specific attachment content during inline preview. An attacker can send a crafted email with a malicious attachment that executes arbitrary JavaScript in the victim's browser session when previewed. This could allow the attacker to perform unauthorized actions, exfiltrate data, or access sensitive information on behalf of the user.

Recommendations Update Zimbra Collaboration (ZCS) to version 10.1.17 or later.