DaystoPatch

Zimbra (Synacor)Exploited incident

Zimbra Webmail RestFilter unauthenticated local file inclusion (CVE-2025-68645)

CVE-2025-68645High, CVSS 8.8In CISA's Known Exploited Vulnerabilities catalog since 22 Jan 2026

  • Exploited after a fix existed
FixedFixed for every supported version on the day it became public.

Response

Silence
same day
First public report to first vendor statement
Exposure
same day
First public report to first fix
Follow-through
same day
First public report to a fix for every supported version
  • Vendor silent
  • Vendor statement, no fix
  • Fixed for some versions
  • Fixed when disclosed
  • Date only, no time of day

Timeline and evidence

Open a moment to see its source and archived quote.

  1. First public report

    date only

    Zimbra Security Center (Wayback snapshot)CuratedQuote verified

    ZCS 10.1.13 was released on Thu Nov 06 2025.

    Coordinated disclosure (reporter devme4f from VNPT-VCI per Zimbra's table); fix releases were the first public information. CVE record published 2025-12-22.

    Recorded time
    Precision
    Date only (no time of day is shown)
    Origin
    Curated. Found by a researcher, with a verbatim quote and link.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:c12fa055432dba11…
    Used in metrics
    Yes
    Dispute this timestamp
    3 more sources for this moment
    CVE.org record CVE-2025-68645ClaimedQuote verified22 Dec 2025, 00:00 UTC

    A Local File Inclusion (LFI) vulnerability exists in the Webmail Classic UI of Zimbra Collaboration (ZCS) 10.0 and 10.1 because of improper handling of user-supplied request parameters in the

    CVE record published.

    Recorded time
    Precision
    To the minute
    Origin
    Claimed. The date the source gives.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:bd41274aaa620be6…
    Used in metrics
    No, kept for the record
    Dispute this timestamp
    Bluesky postClaimedQuote not checked yet22 Dec 2025, 19:40 UTC

    CVE-2025-68645 - Zimbra Webmail Classic UI LFI Vulnerability

    Earliest third-party post we hold.

    Source
    Bluesky post social
    Recorded time
    Precision
    To the minute
    Origin
    Claimed. The date the source gives.
    Quote check
    Not checked yet
    Snapshot
    No archived snapshot
    Used in metrics
    No, kept for the record
    Dispute this timestamp
    CISA KEV (CVE-2025-68645)ClaimedQuote verified22 Jan 2026

    Synacor Zimbra Collaboration Suite (ZCS) PHP Remote File Inclusion Vulnerability

    Added to CISA's KEV catalog on 2026-01-22.

    Recorded time
    Precision
    Date only (no time of day is shown)
    Origin
    Claimed. The date the source gives.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:ef8fffede5c47200…
    Used in metrics
    No, kept for the record
    Dispute this timestamp

  2. Vendor statement

    date onlysame day

    Zimbra Security Center (Wayback snapshot)CuratedQuote verified

    ZCS 10.1.13 was released on Thu Nov 06 2025.

    Recorded time
    Precision
    Date only (no time of day is shown)
    Origin
    Curated. Found by a researcher, with a verbatim quote and link.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:c12fa055432dba11…
    Used in metrics
    Yes
    Dispute this timestamp

  3. First workaround

    No official mitigation found yet.

  4. First fix

    date onlysame day

    Zimbra Security Center (Wayback snapshot)CuratedQuote verified

    ZCS 10.1.13 was released on Thu Nov 06 2025.

    Security Center entry lists 'Addressed an unauthenticated local file inclusion vulnerability in the RestFilter. CVE-2025-68645'; advisories table: fixed in 10.1.13 and 10.0.18. wiki.zimbra.com was in maintenance on 2026-10-22, so Wayback captures are cited.

    Recorded time
    Precision
    Date only (no time of day is shown)
    Origin
    Curated. Found by a researcher, with a verbatim quote and link.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:c12fa055432dba11…
    Used in metrics
    Yes
    Dispute this timestamp

  5. Fixed for all versions

    date onlysame day

    Zimbra Security Center (Wayback snapshot)CuratedQuote verified

    ZCS 10.0.18 was released on Thu Nov 06 2025.

    Recorded time
    Precision
    Date only (no time of day is shown)
    Origin
    Curated. Found by a researcher, with a verbatim quote and link.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:c12fa055432dba11…
    Used in metrics
    Yes
    Dispute this timestamp

Send this to your boss

No brief for this incident yet. We write one for every open incident and every critical bug exploited before a fix.

Affected products

  • Zimbra Collaboration Suite 10.0 before 10.0.18, 10.1 before 10.1.13 (Webmail Classic UI, /h/rest)
How we built this timeline

Coordinated disclosure, exploited later: CrowdSec's CVE tracker (tracker.crowdsec.net/cves/CVE-2025-68645) says 'CrowdSec has been tracking this vulnerability and its exploits since 14th of January 2026', after the 6 Nov 2025 fixes and the 22 Dec 2025 CVE publication; CISA added it to KEV on 22 Jan 2026.

Fixed in the same releases as CVE-2025-66376 but kept separate (see that incident's notes). CVSS 8.8 is the CISA-ADP score in the CVE record (Zimbra lists 'TBD').

Related

Zimbra (Synacor) report card