CVE-2026-115785
CVE-2026-115785 · Zimbra Collaboration Suite Data Source Test SMTP Command Injection via Unsanitized Email Address
This page contains facts from public vulnerability sources. Check the original advisory before updating.
An SMTP command injection vulnerability in the data-source testing functionality of Zimbra Collaboration Suite (ZCS) allows an ordinary authenticated user with account options enabled to inject CR/LF into the emailAddress inserted into an SMTP envelope command by a JSON SOAP request. After a successful preliminary POP3 or IMAP login, Zimbra sends the injected commands to the selected SMTP service. If that service accepts the pipelined transaction, the attacker can submit mail with attacker-selected recipients, headers and body content without victim interaction. The vulnerable command-construction path is present in ZCS 10.1.16 and 10.1.20.
CVSS 4.3 · Medium · EPSS 0.7%
- Published
- Updated
Affected products and versions
zimbra collaboration suite
- Versions
- ≥ 0, ≤ 10.1.20: Affected (semver)
No fix published