Add CVE-2025-68645 vulnerability documentation

Document details the Zimbra Collaboration Suite file inclusion vulnerability, including its CVSS score, affected versions, and potential impact.

CVE-2025-68645.md

@@ -0,0 +1,13 @@
+**Updated document date:  December 30, 2025** 
+
+## Zimbra Collaboration Suite /h javax.servlet.include.path_info File Inclusion Vulnerability (CVE-2025-68645)
+|   **Vulnerability**  |Zimbra Collaboration Suite /h javax.servlet.include.path_info File Inclusion Vulnerability (CVE-2025-68645)|
+| :----:   | :-----|
+|  **Chinese name**  |Zimbra Collaboration Suite /h javax.servlet.include.path_info 文件包含漏洞（CVE-2025-68645）|
+| **CVSS core**  | 		6.5 |
+| **FOFA Query**  (click to view the results directly)|  [app="zimbra-邮件系统"]
+| **Number of assets affected**  | 70W+ |
+| **Description**  |A Local File Inclusion (LFI) vulnerability exists in the Webmail Classic UI of Zimbra Collaboration (ZCS) versions 10.0 and 10.1. Due to improper handling of user-supplied request parameters in the RestFilter servlet, an unauthenticated remote attacker can craft malicious requests to the /h/rest endpoint to influence internal request dispatching and include arbitrary files from the WebRoot directory.|
+| **Impact** | An unauthenticated attacker can read sensitive configuration files, account information, and application source code on the server, which may facilitate further attacks and pose a significant security risk.|
+
+![](https://img.cdn1.vip/i/69539d412cc20_1767087425.webp)