mirror of
https://github.com/gobysec/GobyVuls.git
synced 2026-10-24 08:54:28 +00:00
Goby
5678e23f67
Document details the Zimbra Collaboration Suite file inclusion vulnerability, including its CVSS score, affected versions, and potential impact.
1.3 KiB
1.3 KiB
Updated document date: December 30, 2025
Zimbra Collaboration Suite /h javax.servlet.include.path_info File Inclusion Vulnerability (CVE-2025-68645)
| Vulnerability | Zimbra Collaboration Suite /h javax.servlet.include.path_info File Inclusion Vulnerability (CVE-2025-68645) |
|---|---|
| Chinese name | Zimbra Collaboration Suite /h javax.servlet.include.path_info 文件包含漏洞（CVE-2025-68645） |
| CVSS core | 6.5 |
| FOFA Query (click to view the results directly) | [app="zimbra-邮件系统"] |
| Number of assets affected | 70W+ |
| Description | A Local File Inclusion (LFI) vulnerability exists in the Webmail Classic UI of Zimbra Collaboration (ZCS) versions 10.0 and 10.1. Due to improper handling of user-supplied request parameters in the RestFilter servlet, an unauthenticated remote attacker can craft malicious requests to the /h/rest endpoint to influence internal request dispatching and include arbitrary files from the WebRoot directory. |
| Impact | An unauthenticated attacker can read sensitive configuration files, account information, and application source code on the server, which may facilitate further attacks and pose a significant security risk. |
