Description

In Zimbra Collaboration before 10.1.17, a local file inclusion (LFI) vulnerability exists in the Zimbra Classic Web Client due to improper validation of the fu request parameter. An unauthenticated attacker can exploit this vulnerability by supplying a crafted path, potentially allowing unauthorized disclosure of protected files, such as WEB-INF/web.xml, within the web application directory. This occurs in the Forward servlet.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "3.1",
  "pubDate": "2026-08-13T16:19:06.593Z",
  "pubdate": "2026-08-13T16:19:06.593Z",
  "executiveSummary": "A local file inclusion (LFI) vulnerability affects the Zimbra Classic Web Client in Zimbra Collaboration before 10.1.17. The flaw stems from improper input validation of the fu request parameter handled by the Forward servlet.\nAn unauthenticated attacker can exploit this vulnerability over the network by submitting a specially crafted path to the affected endpoint. Successful exploitation results in unauthorized disclosure of sensitive protected files located within the web application directory, such as WEB-INF/web.xml.\nThis vulnerability exposes internal application architecture and configuration data, which increases the risk of subsequent attacks. The exploit requires no prior authentication or elevated privileges, making it accessible to remote malicious actors targeting exposed instances of the Zimbra Collaboration platform.",
  "technicalDetails": "The vulnerability resides in the Forward servlet of the Zimbra Classic Web Client within Zimbra Collaboration before 10.1.17. The root cause is insufficient input validation and sanitization of the fu request parameter supplied by clients during HTTP requests.\nThe Forward servlet fails to adequately restrict or normalize user-supplied input passed through the fu parameter. Consequently, an unauthenticated remote attacker can supply crafted relative or absolute path traversal sequences to bypass intended application directory restrictions.\nThe attack flow proceeds as follows: First, the unauthenticated attacker crafts an HTTP request targeting the vulnerable Forward servlet within the Zimbra Classic Web Client. Second, the attacker injects malicious traversal payloads into the fu request parameter. Third, the servlet processes the parameter without proper validation, interpreting the crafted path as a local file reference within the web application directory. Finally, the application reads the targeted resource and returns its contents in the HTTP response.\nThis exploitation vector enables unauthorized disclosure of critical configuration and deployment files, such as WEB-INF/web.xml. The vulnerability can be exploited across the network without authentication or specialized privileges, posing a direct threat to confidentiality."
}