CVE-2025-68645

CVE-2025-68645 is a Local File Inclusion (LFI) vulnerability, mapped to CWE-98, affecting the Webmail Classic UI in Zimbra Collaboration Suite (ZCS) versions 10.0 and 10.1. The flaw arises from improper handling of user-supplied request parameters within the RestFilter servlet, enabling attackers to manipulate internal request dispatching. Published on 2025-12-22, it carries a CVSS v3.1 base score of 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H), reflecting high potential impact across confidentiality, integrity, and availability.

An unauthenticated remote attacker can exploit the vulnerability by crafting requests to the /h/rest endpoint, tricking a user into interacting with a malicious payload—such as clicking a link in a phishing email. Successful exploitation allows inclusion of arbitrary files from the WebRoot directory, potentially exposing sensitive configuration data, source code, or other server files, depending on directory contents and permissions.

Zimbra's Security Center wiki and Responsible Disclosure Policy provide relevant advisory details on patches and mitigation steps. The vulnerability also appears in CISA's Known Exploited Vulnerabilities catalog, signaling real-world exploitation by threat actors. Security practitioners should prioritize patching affected ZCS instances and monitor for anomalous /h/rest requests.