> CVE-2025-68645

« BACK_TO_HOME
PUBLISHED
2025-12-22 18:16
MODIFIED
2025-12-22 18:16
EPSS (Prob. Exploit)
48.87%
Top 1.1%
⚠ CISA_KEV
⚡ EPSS ÉLEVÉ (48.9%)
🎯 NUCLEI TEMPLATE
DATA SOURCES:
NVD 🔗 2025-12-22 CVE PROJECT 🔗 2026-01-19 CISA KEV 🔗 FIRST EPSS 🔗 2026-10-25 OSV 🔗 2026-09-20 NUCLEI 🔗 2026-01-21

> DESCRIPTION

A Local File Inclusion (LFI) vulnerability exists in the Webmail Classic UI of Zimbra Collaboration (ZCS) 10.0 and 10.1 because of improper handling of user-supplied request parameters in the RestFilter servlet. An unauthenticated remote attacker can craft requests to the /h/rest endpoint to influence internal request dispatching, allowing inclusion of arbitrary files from the WebRoot directory.

> AFFECTED_PRODUCTS

Synacor - Zimbra Collaboration Suite (ZCS)

> OSV (GOOGLE OPEN SOURCE VULNERABILITIES)

AFFECTED PACKAGES:
Unknown / Unknown
14 versions affected
Unknown / Unknown
22 versions affected
Unknown / Unknown
1 versions affected
Unknown / Unknown
7 versions affected

> NUCLEI TEMPLATES

Des templates Nuclei sont disponibles pour scanner cette vulnérabilité.

🎯
CVE-2025-68645.yaml
http/cves/2025/CVE-2025-68645.yaml
Usage: nuclei -t http/cves/2025/CVE-2025-68645.yaml -u target.com

> HISTORIQUE DES MODIFICATIONS

Première apparition
22/12/2025 18:16
Source: NVD
📊 ENRICHISSEMENT 22/01/2026 19:15
KEV
Champ modifié: Catalogue KEV
Ancienne valeur:
Non
Nouvelle valeur:
Oui
📊 ENRICHISSEMENT 19/01/2026 17:38
CVEPROJECT
Champ modifié: CVE Project
Ancienne valeur:
Non
Nouvelle valeur:
Oui
Total des modifications: 2 Dernière mise à jour: 9 months ago

> REFERENCES

https://wiki.zimbra.com/wiki/Security_Center
https://wiki.zimbra.com/wiki/Zimbra_Responsible_Disclosure_Policy
« BACK_TO_HOME