Zimbra Classic Web Client Vulnerability Allows Arbitrary JavaScript Execution

A critical security flaw has been discovered and patched in the Zimbra Collaboration Suite (ZCS) Classic Web Client, exposing millions of business users to the risk of arbitrary JavaScript execution through stored cross-site scripting (XSS).

Tracked as CVE-2025-27915, this vulnerability affects ZCS versions 9.0, 10.0, and 10.1 prior to the latest patch releases, and is considered a significant threat to enterprise email security.

Technical Details and Exploitation

The vulnerability arises from insufficient sanitization of HTML content within ICS calendar invite files.

Attackers can craft malicious ICS entries that, when delivered via email and opened in the Classic Web Client, execute embedded JavaScript through an ontoggle event inside a 

This enables attackers to run arbitrary code in the victim’s browser session, potentially leading to unauthorized actions such as email redirection, data exfiltration, or even session hijacking.

Once exploited, the attacker can manipulate email filters to forward messages to an attacker-controlled address, steal session cookies, or launch further phishing attacks—all without the victim’s awareness.

 The attack is particularly effective because it leverages the trusted context of calendar invitations, a common workflow in business environments.

Affected Versions and Patch Information

The vulnerability impacts the following Zimbra Collaboration Suite versions:

• 9.0.0 up to (but not including) Patch 44
• 10.0.0 up to (but not including) 10.0.13
• 10.1.0 up to (but not including) 10.1.5

Zimbra has released critical security patches to address this issue. Users are strongly urged to upgrade to the latest patch versions—9.0.0 Patch 46, 10.0.15, or 10.1.9—to mitigate the risk of exploitation.

Vulnerability Data Table

Mitigation and Recommendations

Zimbra administrators should immediately upgrade to the latest patch versions to protect their environments. In addition, organizations are advised to:

• Enforce strict input validation and content sanitization for all user-supplied data
• Restrict execution of embedded scripts within email and calendar content
• Educate users about the risks of opening unsolicited calendar invites

This vulnerability is part of a broader wave of critical flaws recently addressed in Zimbra, including SQL injection and server-side request forgery (SSRF) bugs.

The rapid response and patch releases underscore the importance of timely software updates and proactive security management in enterprise collaboration platforms.

For the latest updates and patch instructions, Zimbra users should refer to official advisories and apply all recommended security updates without delay.

Failure to act could leave organizations exposed to data theft, account compromise, and further exploitation by threat actors.

Find this News Interesting! Follow us on Google News, LinkedIn, and X to Get Instant Updates