CVE-2026-115785
CVE-2026-115785 · Zimbra Collaboration Suite Data Source Test SMTP Command Injection via Unsanitized Email Address
Diese Seite enthält Fakten aus öffentlichen Sicherheitsquellen. Lesen Sie vor dem Aktualisieren die Originalmeldung.
An SMTP command injection vulnerability in the data-source testing functionality of Zimbra Collaboration Suite (ZCS) allows an ordinary authenticated user with account options enabled to inject CR/LF into the emailAddress inserted into an SMTP envelope command by a JSON SOAP request. After a successful preliminary POP3 or IMAP login, Zimbra sends the injected commands to the selected SMTP service. If that service accepts the pipelined transaction, the attacker can submit mail with attacker-selected recipients, headers and body content without victim interaction. The vulnerable command-construction path is present in ZCS 10.1.16 and 10.1.20.
CVSS 4.3 · Mittel · EPSS 0,7%
- Veröffentlicht
- Aktualisiert
Betroffene Produkte und Versionen
zimbra collaboration suite
- Softwareversionen
- ≥ 0, ≤ 10.1.20: Betroffen (semver)
Keine Korrektur veröffentlicht