CVE-2025-66376

CVE-2025-66376 is a stored cross-site scripting (XSS) vulnerability (CWE-79) in the Classic UI of Zimbra Collaboration Suite (ZCS) versions 10 before 10.0.18 and 10.1 before 10.1.13. It arises from the improper handling of Cascading Style Sheets (CSS) @import directives embedded in HTML email messages, allowing malicious payloads to be stored and executed when rendered in the Classic UI.

Unauthenticated attackers (PR:N) can exploit this vulnerability over the network (AV:N) with low complexity (AC:L) and no user interaction required (UI:N), as indicated by its CVSS v3.1 base score of 7.2 (S:C/C:L/I:L/A:N). By sending a crafted HTML email containing a malicious CSS @import directive, the attacker can store the payload server-side. When victims access the email via the affected Classic UI, the XSS executes in the context of the Zimbra application, potentially enabling session hijacking, data theft, or further compromise with low confidentiality and integrity impacts due to the changed scope.

Zimbra's security advisories and release notes for versions 10.0.18 and 10.1.13 document fixes for this issue, recommending immediate upgrades to these patched releases. Additional guidance is available in the Zimbra Security Center, Security Advisories, and Responsible Disclosure Policy on their wiki.