CVE-2022-37042

CRITICAL

Zimbra Collaboration Suite (ZCS) 8.8.15 and 9.0 has mboximport functionality that receives a ZIP archive and extracts files from it. By bypassing authentication (i.e., not having an authtoken), an attacker can upload arbitrary files to the system, leading to directory traversal and remote code execution. NOTE: this issue exists because of an incomplete fix for CVE-2022-27925.

CVSS v3.1 Score

9.8
CRITICAL
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack Vector
NETWORK
Complexity
LOW
Privileges
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality
HIGH
Integrity
HIGH
Availability
HIGH
Published: 8/12/2022Modified: 8/4/2026

Related Intelligence (1)

CRITICALZero Day

When Business Email Compromise Starts Rewriting Reality

Business Email Compromise (BEC) operates on a familiar playbook. Threat actors breach a mailbox, silently monitor operations, map approval chains, and ultimately exploit that access to divert funds or exfiltrate sensitive assets. This dynamic is central to our analysis as we kick off a series around Rapid7's collaborative research with Zimbra; upcoming installments will explore technical details a

CVE-2024-45519CVE-2025-27915
Rapid7

References (7)

http://packetstormsecurity.com/files/168146/Zimbra-Zip-Path-Traversal.htmlExploitThird Party Advisoryhttps://wiki.zimbra.com/wiki/Security_CenterPatchVendor Advisoryhttps://wiki.zimbra.com/wiki/Zimbra_Security_AdvisoriesVendor Advisoryhttp://packetstormsecurity.com/files/168146/Zimbra-Zip-Path-Traversal.htmlExploitThird Party Advisoryhttps://wiki.zimbra.com/wiki/Security_CenterPatchVendor Advisoryhttps://wiki.zimbra.com/wiki/Zimbra_Security_AdvisoriesVendor Advisoryhttps://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2022-37042US Government Resource