Description

When OnlyOffice/Document Editing is available, an unauthenticated remote attacker with access to an existing supported public Briefcase document can abuse unsigned save fields to perform path-traversal writes and execute commands as zimbra.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.8",
  "pubDate": "2026-09-25T14:17:23.550Z",
  "pubdate": "2026-09-25T14:17:23.550Z",
  "executiveSummary": "This vulnerability involves an arbitrary file write capability within the Zimbra collaboration suite, specifically affecting the OnlyOffice/Document Editing integration.\nThe flaw allows an unauthenticated remote attacker to perform path-traversal attacks by manipulating unsigned 'save' fields during the document saving process.\nBy writing arbitrary content to sensitive locations on the underlying filesystem, an attacker can achieve remote code execution (RCE) with the privileges of the 'zimbra' service user.\nThe impact of this vulnerability is critical, as it grants full control over the application's environment, potentially leading to unauthorized data access, persistence, and total system compromise.\nExploitation requires access to an existing, publicly accessible document within the Zimbra Briefcase component. No prior authentication is necessary to initiate the attack sequence, significantly increasing the risk profile for exposed installations.\nOrganizations using Zimbra with the OnlyOffice integration are at high risk if they allow public access to Briefcase documents.",
  "technicalDetails": "The vulnerability resides in the interface between the Zimbra core and the integrated OnlyOffice document editing service. The root cause is the inadequate validation and sanitization of input parameters within the document save operation, specifically regarding the handling of unsigned 'save' fields.\nWhen a user saves a document through the OnlyOffice integration, the application processes request parameters that dictate the storage path of the document. An attacker can supply malicious input containing directory traversal sequences (e.g., ../) within these fields.\nBecause the server-side logic fails to enforce strict path normalization or validate that the intended write operation remains within the designated sandbox directory, the application interprets these traversal sequences literally. This permits the 'zimbra' service process to write files to arbitrary locations on the filesystem.\nThe attack flow proceeds as follows: 1) The attacker identifies a publicly accessible document stored within the Zimbra Briefcase. 2) The attacker intercepts or crafts a request to the document save endpoint associated with the OnlyOffice integration. 3) The attacker injects path-traversal sequences into the unsigned save fields to target critical paths (such as the web root or cron directories). 4) Upon submission, the application writes the provided payload to the attacker-defined target location.\nBy targeting executable scripts, configuration files, or temporary directories mapped to the web server, an attacker can force the execution of arbitrary commands. Since the Zimbra service runs under the 'zimbra' system user, the injected payload inherits these permissions, facilitating full execution capabilities within the server environment.\nThis vulnerability demonstrates a failure in secure input handling and architectural isolation, where user-controllable input from an external document editing service influences filesystem operations without sufficient mediation. Post-exploitation activities typically include the deployment of web shells or reverse shells to establish persistent remote access."
}