CVE-2026-73573

Name of the Vulnerable Software and Affected Versions Zimbra Collaboration (ZCS) versions prior to 10.1.17

Description An issue exists in the Zimbra Briefcase document editing functionality where the packages parameter is not properly validated. An authenticated attacker can use a crafted path traversal sequence—a technique used to access files and directories outside the intended folder—to potentially disclose sensitive files within the web application directory.

Recommendations Update Zimbra Collaboration (ZCS) to version 10.1.17 or later. Restrict the use of the packages parameter in the Briefcase document editing functionality as a temporary mitigation.