CVE-2025-68645

The Local File Inclusion (LFI) vulnerability in the Webmail Classic UI of Zimbra Collaboration Suite versions 10.0 and 10.1 arises from inadequate validation of user-supplied request parameters within the RestFilter servlet. This flaw allows an attacker to manipulate requests sent to the /h/rest endpoint, potentially leading to the inclusion of arbitrary files from the WebRoot directory. The vulnerability stems from the application's failure to properly sanitize input, enabling an attacker to craft malicious requests that can access sensitive files on the server. This misconfiguration can expose critical system files, configuration files, or even user data, depending on the server's file structure and permissions.

Exploitation of this vulnerability can occur through various attack vectors. An unauthenticated remote attacker can initiate a crafted request to the vulnerable endpoint, effectively bypassing any authentication mechanisms that may be in place. Once the attacker successfully includes a file, they can leverage the information contained within it to escalate their attack, potentially leading to further exploitation of the system or lateral movement within the network. For example, an attacker might include configuration files that contain database credentials or other sensitive information, which could then be used to gain deeper access to the system or to pivot to other connected systems.

The real-world impact of this vulnerability can be significant, particularly for organizations that rely on Zimbra Collaboration Suite for their email and collaboration needs. The CVSS score of 8.8 indicates a high severity level, suggesting that successful exploitation could lead to severe consequences, including data breaches, loss of confidentiality, and potential regulatory penalties. Businesses may face reputational damage, loss of customer trust, and financial repercussions due to the exposure of sensitive information. Additionally, the vulnerability could serve as a gateway for more sophisticated attacks, increasing the overall risk profile for organizations that fail to address it promptly.

To detect and mitigate this vulnerability, organizations should implement a multi-layered security approach. Regular vulnerability assessments and penetration testing should be conducted to identify and remediate weaknesses in the application. Employing web application firewalls (WAFs) can help filter and monitor HTTP requests, blocking potentially malicious input before it reaches the application. Furthermore, developers should adhere to secure coding practices, ensuring that user input is properly validated and sanitized. Keeping the Zimbra Collaboration Suite up to date with the latest security patches is crucial, as updates often include fixes for known vulnerabilities.

In conclusion, the Local File Inclusion vulnerability in Zimbra Collaboration Suite poses a serious threat to organizations using this platform. The potential for unauthorized access to sensitive files and the subsequent risks associated with data breaches necessitate immediate attention. By understanding the technical details, potential attack vectors, and implementing effective detection and mitigation strategies, organizations can significantly reduce their exposure to this vulnerability and enhance their overall cybersecurity posture.

CSURFACE threat intelligence has detected a marked escalation in activity related to CVE-2025-68645, with telemetry indicating a significant uptick in exploit attempts targeting the Zimbra Collaboration Suite’s Webmail Classic UI. This increase coincides with a modest rise in the Exploit Prediction Scoring System (EPSS) score, reflecting growing confidence in the exploitability of this Local File Inclusion vulnerability. The emergence of multiple new proof-of-concept exploits on public repositories further amplifies the risk by lowering the barrier for adversaries to develop and deploy attacks. Although ransomware usage linked to this vulnerability remains unconfirmed, the expanding exploit landscape and heightened detection trends suggest an elevated threat posture. For defenders, this means increased vigilance is warranted as exploitation attempts may become more frequent and sophisticated, potentially leading to unauthorized access to sensitive internal files. Consequently, the overall risk rating for CVE-2025-68645 should be considered elevated, underscoring the urgency for continuous monitoring and proactive threat detection efforts.

Update 2 — June 07, 2026

CSURFACE threat intelligence has identified a marked escalation in exploitation attempts targeting CVE-2025-68645, evidenced by a noticeable uptick in detection activity across our sensors. This increase coincides with the emergence of additional publicly available proof-of-concept exploits, broadening the toolkit accessible to threat actors and lowering the barrier for exploitation. Despite a slight decline in the EPSS score, the overall threat environment has intensified due to these qualitative shifts. The expanding exploit landscape suggests adversaries are actively refining and disseminating attack methods, which could lead to more frequent and varied attempts to leverage the Local File Inclusion vulnerability in Zimbra Collaboration Suite. For defenders, this evolving scenario underscores a heightened risk of unauthorized access to sensitive internal files, necessitating sustained vigilance. Consequently, the risk level associated with CVE-2025-68645 should be considered elevated, reflecting an increased likelihood of exploitation in the near term.

Update 3 — June 20, 2026

CSURFACE threat intelligence has detected a modest increase in exploitation attempts targeting CVE-2025-68645, accompanied by a continued decline in the EPSS score. This divergence suggests that while adversaries are incrementally intensifying their probing activities, the overall likelihood of widespread exploitation is diminishing, potentially reflecting improved defensive postures or reduced attacker prioritization. Additionally, new proof-of-concept exploits have surfaced across multiple public repositories, indicating sustained interest and ongoing refinement of attack techniques within the threat actor community. Although ransomware usage linked to this vulnerability remains unconfirmed, the expanding availability of exploit code lowers the barrier for opportunistic attackers to leverage the Local File Inclusion flaw. Consequently, the threat landscape for CVE-2025-68645 remains dynamic, warranting close monitoring. The risk level should be viewed as moderately elevated due to persistent adversary engagement and the proliferation of exploit resources, despite the downward trend in predictive exploit scoring.