CVE-2022-27925

KEV catalog · CISA Known Exploited Vulnerabilities

CVE-2022-27925 7.2

Synacor · Zimbra Collaboration Suite (ZCS) · Added 2022-08-11 · Published 2022-04-21

3-Day Required PoC Available KEV Automatable Active Exploitation

Details

VulnerabilitySynacor Zimbra Collaboration Suite (ZCS) Arbitrary File Upload Vulnerability

VendorSynacor

ProductZimbra Collaboration Suite (ZCS)

Date added2022-08-11

Due date2022-09-01

CISA catalogView on CISA KEV catalog

Required actionApply updates per vendor instructions.

CWECWE-22

CVSS vectorCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Descriptions

KEV: Synacor Zimbra Collaboration Suite (ZCS) contains flaw in the mboximport functionality, allowing an authenticated attacker to upload arbitrary files to perform remote code execution. This vulnerability was chained with CVE-2022-37042 which allows for unauthenticated remote code execution.

NVD: Zimbra Collaboration (aka ZCS) 8.8.15 and 9.0 has mboximport functionality that receives a ZIP archive and extracts files from it. An authenticated user with administrator rights has the ability to upload arbitrary files to the system, leading to directory traversal.

Compliance SSVC + BOD 26-04

Automatableyes

Technical impacttotal

Exploitation statusactive

3-day qualifyingYes

Public timeline3 days + forensic

Non-public timeline3 days + forensic

Forensic (public)Required

Forensic (non-public)Required

Research metadata

Last researched2026-09-12 09:42 UTC

Wall time0.4s

Searches1

Component defaultyes

Sources https://nvd.nist.gov/vuln/detail/CVE-2022-27925
https://www.volexity.com/blog/2022/08/10/mass-exploitation-of-unauthenticated-zimbra-rce-cve-2022-27925/
https://www.cisa.gov/news-events/cybersecurity-advisories/aa22-228a
https://wiki.zimbra.com/wiki/Zimbra_Releases/9.0.0/P24
https://wiki.zimbra.com/wiki/Zimbra_Releases/8.8.15/P31
https://github.com/vnhacker1337/CVE-2022-27925-PoC
https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-37042.yaml

Hunting hypothesis agent

Hunt mailboxd access logs for POSTs to /service/extension/backup/mboximport carrying ZIPs with ../ traversal entries that drop JSP files under webapps, then GETs to the newly written JSP path.

Research details

Componentmboximport ZIP extraction in MailboxImportServlet (/service/extension/backup/mboximport)

PreconditionsVulnerable ZCS 8.8.15 before Patch 31 or 9.0 before Patch 24; a valid administrator authtoken is required, or the endpoint can be reached unauthenticated by chaining CVE-2022-37042. Network access to the mailboxd mboximport endpoint (80/443 or 7071) is needed, and the attacker POSTs a ZIP whose member filename contains ../ sequences so the extracted file lands in a web-accessible directory. agent

DeliveryHTTP POST of a crafted ZIP archive to /service/extension/backup/mboximport with ../ traversal member filenames; the dropped JSP is then requested to execute code.

Public PoCyes

PoC URLs https://github.com/vnhacker1337/CVE-2022-27925-PoC
https://github.com/0xf4n9x/CVE-2022-37042
https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-37042.yaml
https://github.com/Chocapikk/CVE-2022-27925-Revshell Third-party repos; verify before use.

Advisoryhttps://wiki.zimbra.com/wiki/Zimbra_Releases/9.0.0/P24

Exploit notesCVSS attack complexity: LOW | HIGH severity (CVSS 7.0-8.9). Originally required administrator credentials, but Volexity showed the mboximport endpoint could be reached without authentication via CVE-2022-37042, making it an unauthenticated RCE in practice. Public PoC tooling (vnhacker1337, 0xf4n9x, Chocapikk) and a Nuclei template exist.

SummaryCVE-2022-27925 is a directory-traversal and arbitrary-file-upload flaw in Zimbra Collaboration Suite's mboximport functionality. The endpoint accepts a ZIP archive and extracts member files without sanitising ../ path sequences, so an authenticated administrator - or an unauthenticated attacker chaining CVE-2022-37042 - can write a JSP webshell into a web-accessible path and execute remote code. Zimbra fixed the traversal in 8.8.15 Patch 31 and 9.0.0 Patch 24; it was mass-exploited in mid-2022, with Volexity identifying over 1,000 compromised servers.

Tia coverage

First reported2026-09-24

When Tia's reporting first covered this CVE and whether a report claimed exploitation before the KEV listing. Lead-time deltas are measured from the exploitation report only — plain coverage is not exploitation intel. See the story links under Mentioned in for coverage detail.

Mentioned in

when-business-email-compromise-starts-rewriting-reality

Record schema v1.0. Enrichment is research-grade, not a substitute for analyst review.