CVE-2026-73573CWE-24

CVE-2026-73573

Low · published August 13, 2026

CVSS v3.1
3.1
EPSS
0%
Percentile
22.3
In the wild
Unconfirmed
What it is

In Zimbra Collaboration (ZCS) before 10.1.17, a path traversal vulnerability exists in the Zimbra Briefcase document editing functionality due to improper validation of the packages parameter. An authenticated attacker can exploit this vulnerability by supplying a crafted path traversal sequence, potentially allowing unauthorized disclosure of sensitive files within the web application directory.

The record
Technical detail
CVSS v3.1
3.1 · LOW
Vector
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00301 · 22.3th percentile
Weakness
CWE-24 · Path Traversal: '../filedir'
Published
2026-08-13T20:19Z
Affected products (1)
ProductVersionsFixed in
synacor/zimbra_collaboration_suite< 10.1.1710.1.17
References (2)
https://wiki.zimbra.com/wiki/Zimbra_Responsible_Disclosure_Policy · [email protected]https://wiki.zimbra.com/wiki/Zimbra_Security_Advisories · [email protected]
EPSS history
Timeline
  • 13 AUG 15:22Z
    In Zimbra Collaboration (ZCS) before 10.1.17, a path traversal vulnerability exists in the Zimbra Briefcase document editing functionality due to improper…
    cvelistv5