CVE-2022-37042Synacor Zimbra Collaboration Suite (ZCS) Authentication Bypass Vulnerability

Zimbra Collaboration Suite (ZCS) 8.8.15 and 9.0 has mboximport functionality that receives a ZIP archive and extracts files from it. By bypassing authentication (i.e., not having an authtoken), an attacker can upload arbitrary files to the system, leading to directory traversal and remote code execution. NOTE: this issue exists because of an incomplete fix for CVE-2022-27925.

9.8 CRITICALEPSS 92.07%⚡ Known Exploited (CISA KEV)NVD: Published

Last updated: 2026-08-04 03:55 UTC

Overview Affected Products References

NVD CVE.org

Overview

Severity

Score	Severity	Version	Vector String
9.8	CRITICAL	3.1CISA-ADP	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Details

CVE ID: CVE-2022-37042
Status: Published
Assigner (CNA): mitre
Published: Aug 11, 2022
Last modified: 2026-08-04 03:55 UTC
Weaknesses: CWE-23

Sources

NVD (unavailable at last refresh)
CVE.org
CISA KEV
FIRST EPSS

Refreshed hourly from the sources above. Last fetched 2026-11-08 14:27 UTC.