CVE-2025-68645 - A Local File Inclusion (LFI) vulnerability exists in the Webmail Classic UI of Zimbra Collaboration (ZCS) 10.0 and 10.1 because of improper handling of user-supplied request parameters in the RestFilter servlet

Back Back to CVE browser

HIGH KEV

A Local File Inclusion (LFI) vulnerability exists in the Webmail Classic UI of Zimbra Collaboration (ZCS) 10.0 and 10.1 because of improper handling of user-supplied request parameters in the RestFilter servlet

Published Dec 22, 2025 ·Due Feb 12, 2026

8.8

HIGH

CVSS 3.1

EPSS 48.87%

Description

A Local File Inclusion (LFI) vulnerability exists in the Webmail Classic UI of Zimbra Collaboration (ZCS) 10.0 and 10.1 because of improper handling of user-supplied request parameters in the RestFilter servlet. An unauthenticated remote attacker can craft requests to the /h/rest endpoint to influence internal request dispatching, allowing inclusion of arbitrary files from the WebRoot directory.

Affected products

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-98

References (3)

https://wiki.zimbra.com/wiki/Security_Center
Release NotesVendor Advisory
https://wiki.zimbra.com/wiki/Zimbra_Responsible_Disclosure_Policy
Product
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-68645
government-resourceUS Government Resource

Link	Providers	Tags
https://wiki.zimbra.com/wiki/Security_Center		Release NotesVendor Advisory
https://wiki.zimbra.com/wiki/Zimbra_Responsible_Disclosure_Policy		Product
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-68645		government-resourceUS Government Resource