CVE-2026-73574

Name of the Vulnerable Software and Affected Versions Zimbra Collaboration versions prior to 10.1.17

Description A local file inclusion (LFI) issue exists in the Zimbra Classic Web Client within the Forward servlet. This is caused by improper validation of the fu request parameter, which allows an unauthenticated attacker to use a crafted path to gain unauthorized access to protected files, such as WEB-INF/web.xml, located in the web application directory.

Recommendations Update Zimbra Collaboration to version 10.1.17 or later. Restrict access to the fu parameter in the Forward servlet to minimize the risk of exploitation.