CVEvulnerability
CVE-2026-33371
4.3 MEDIUM
Official page ↗
- Status
- Analyzed
- Published
- 2026-03-20
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 3.1 (134c704f-9b21-4f2e-91b3-4a467353bcc0)
- 4.3 MEDIUM — CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
- Weaknesses
- CWE-611
Description
An issue was discovered in Zimbra Collaboration (ZCS) 10.0 and 10.1. An XML External Entity (XXE) vulnerability exists in the Zimbra Exchange Web Services (EWS) SOAP interface due to improper handling of XML input. An authenticated attacker can submit crafted XML data that is processed by an XML parser with external entity resolution enabled. Successful exploitation may allow disclosure of sensitive local files from the server.
Affected configurations
• synacor zimbra collaboration suite (>= 10.0.0 < 10.1.16)
Related
Weakness · CWE (1)
- CWE-611 Improper Restriction of XML External Entity Reference weakness
References
- https://wiki.zimbra.com/wiki/Security_Center Release Notes, Vendor Advisory
- https://wiki.zimbra.com/wiki/Zimbra_Releases/10.1.16#Security_Fixes Release Notes
- https://wiki.zimbra.com/wiki/Zimbra_Responsible_Disclosure_Policy Product
- https://wiki.zimbra.com/wiki/Zimbra_Security_Advisories Vendor Advisory