CVE-2026-93643CWE-22CWE-863path-traversalbroken-access-control

CVE-2026-93643

Critical · published September 25, 2026

CVSS v3.1
9.8
EPSS
1%
Percentile
61.2
In the wild
Unconfirmed
What it is

When OnlyOffice/Document Editing is available, an unauthenticated remote attacker with access to an existing supported public Briefcase document can abuse unsigned save fields to perform path-traversal writes and execute commands as zimbra.

The record
Technical detail
CVSS v3.1
9.8 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00960 · 61.2th percentile
Weaknesses
CWE-22 · Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'); CWE-863 · Incorrect Authorization
Published
2026-09-25T18:17Z
References (1)
https://wiki.zimbra.com/wiki/Zimbra_Security_Advisories · [email protected]
EPSS history
Timeline
  • 27 SEP 03:28Z
    EPSS moved — → 1%
    epss
  • 25 SEP 13:57Z
    Zimbra Collaboration Suite OnlyOffice Integration Path Traversal Leading to Remote Code Execution via Unauthenticated /downloadas Request
    cvelistv5