DaystoPatch

Zimbra (Synacor)Exploited incident

Zimbra Classic UI cross-site scripting via crafted HTML (CVE-2025-48700)

CVE-2025-48700Medium, CVSS 6.1In CISA's Known Exploited Vulnerabilities catalog since 20 Apr 2026

  • Exploited after a fix existed
FixedFixed for every supported version on the day it became public.

Response

Silence
same day
First public report to first vendor statement
Exposure
same day
First public report to first fix
Follow-through
same day
First public report to a fix for every supported version
  • Vendor silent
  • Vendor statement, no fix
  • Fixed for some versions
  • Fixed when disclosed
  • Date only, no time of day

Timeline and evidence

Open a moment to see its source and archived quote.

  1. First public report

    date only

    Zimbra Security Center (Wayback snapshot)CuratedQuote verified

    ZCS 10.1.4 was released on Tue Dec 17 2024.

    Coordinated disclosure (reporter lebr0nli / Alan Li per Zimbra's advisories table); the fix releases were the first public information. The CVE record was only published on 2025-06-23.

    Recorded time
    Precision
    Date only (no time of day is shown)
    Origin
    Curated. Found by a researcher, with a verbatim quote and link.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:c12fa055432dba11…
    Used in metrics
    Yes
    Dispute this timestamp
    4 more sources for this moment
    CVE.org record CVE-2025-48700ClaimedQuote verified23 Jun 2025, 00:00 UTC

    An issue was discovered in Zimbra Collaboration (ZCS) 8.8.15 and 9.0 and 10.0 and 10.1. A Cross-Site Scripting (XSS) vulnerability in the Zimbra Classic UI allows attackers to execute arbitrary

    CVE record published.

    Recorded time
    Precision
    To the minute
    Origin
    Claimed. The date the source gives.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:af5285100a4acb43…
    Used in metrics
    No, kept for the record
    Dispute this timestamp
    Bluesky postClaimedQuote not checked yet23 Jun 2025, 16:11 UTC

    CVE-2025-48700 - Zimbra Collaboration Cross-Site Scripting (XSS) Vulnerability

    Earliest third-party post we hold.

    Source
    Bluesky post social
    Recorded time
    Precision
    To the minute
    Origin
    Claimed. The date the source gives.
    Quote check
    Not checked yet
    Snapshot
    No archived snapshot
    Used in metrics
    No, kept for the record
    Dispute this timestamp
    CISA KEV (CVE-2025-48700)ClaimedQuote verified20 Apr 2026

    Synacor Zimbra Collaboration Suite (ZCS) Cross-site Scripting Vulnerability

    Added to CISA's KEV catalog on 2026-04-20.

    Recorded time
    Precision
    Date only (no time of day is shown)
    Origin
    Claimed. The date the source gives.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:ef8fffede5c47200…
    Used in metrics
    No, kept for the record
    Dispute this timestamp
    Mastodon postClaimedQuote not checked yet20 Apr 2026, 22:00 UTC

    🚨 [CISA-2026:0420] CISA Adds 8 Known Exploited Vulnerabilities to Catalog ( https:// secdb.nttzen.cloud/security-ad visory/detail/CISA-2026:0420 ) CISA has added 8 new vulnerabilities to its Known

    Earliest third-party post we hold.

    Source
    Mastodon post social
    Recorded time
    Precision
    To the minute
    Origin
    Claimed. The date the source gives.
    Quote check
    Not checked yet
    Snapshot
    No archived snapshot
    Used in metrics
    No, kept for the record
    Dispute this timestamp

  2. Vendor statement

    date onlysame day

    Zimbra Security Center (Wayback snapshot)CuratedQuote verified

    ZCS 10.1.4 was released on Tue Dec 17 2024.

    Recorded time
    Precision
    Date only (no time of day is shown)
    Origin
    Curated. Found by a researcher, with a verbatim quote and link.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:c12fa055432dba11…
    Used in metrics
    Yes
    Dispute this timestamp

  3. First workaround

    No official mitigation found yet.

  4. First fix

    date onlysame day

    Zimbra Security Center (Wayback snapshot)CuratedQuote verified

    ZCS 10.1.4 was released on Tue Dec 17 2024.

    Zimbra's advisories table maps CVE-2025-48700 to fix releases 9.0.0 Patch 43, 10.0.12, 10.1.4 and 8.8.15 Patch 47. wiki.zimbra.com was in maintenance on 2026-10-22, so Wayback captures are cited.

    Recorded time
    Precision
    Date only (no time of day is shown)
    Origin
    Curated. Found by a researcher, with a verbatim quote and link.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:c12fa055432dba11…
    Used in metrics
    Yes
    Dispute this timestamp

  5. Fixed for all versions

    date onlysame day

    Zimbra Security Center (Wayback snapshot)CuratedQuote verified

    ZCS 8.8.15 Patch 47 was released on Tue Dec 17 2024.

    All four branches (10.1.4, 10.0.12, 9.0.0 Patch 43, 8.8.15 Patch 47) were released the same day per the Security Center.

    Recorded time
    Precision
    Date only (no time of day is shown)
    Origin
    Curated. Found by a researcher, with a verbatim quote and link.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:c12fa055432dba11…
    Used in metrics
    Yes
    Dispute this timestamp

Send this to your boss

No brief for this incident yet. We write one for every open incident and every critical bug exploited before a fix.

Affected products

  • Zimbra Collaboration Suite 8.8.15 before Patch 47, 9.0.0 before Patch 43, 10.0 before 10.0.12, 10.1 before 10.1.4
How we built this timeline

Fixed in all supported branches on 17 Dec 2024; CISA added it to KEV on 20 Apr 2026.

No public report of exploitation before the fix was found. Zimbra's advisories table says an LC attribute (zimbra_owasp_strip_alt_tags_with_handlers) 'introduced in previous patch is no longer required', suggesting an earlier partial hardening; it was not counted as a workaround because Zimbra does not tie it to this CVE's disclosure.

CVSS 6.1 is the CISA-ADP score in the CVE record (Zimbra lists 'TBD'; the CNA is MITRE and gives none). R1 check (correction pass 23 Oct 2026): Zimbra's row for this CVE says 'LC attribute zimbra_owasp_strip_alt_tags_with_handlers introduced in previous patch is no longer required and has been removed.' Zimbra maps this CVE only to the 17 Dec 2024 releases and does not present the earlier LC attribute as a fix or mitigation for it, so First fix stays 17 Dec 2024 and no Workaround moment is added.

Related

No related incidents.

Zimbra (Synacor) report card