# CVE-2025-68645

A Local File Inclusion (LFI) vulnerability exists in the Webmail Classic UI of Zimbra Collaboration (ZCS) 10.0 and 10.1 because of improper handling of user-supplied request parameters in the RestFilter servlet. An unauthenticated remote attacker can craft requests to the /h/rest endpoint to influence internal request dispatching, allowing inclusion of arbitrary files from the WebRoot directory.

- Page: https://www.vulneraibility.com/cve/CVE-2025-68645
- CVSS: 8.8
- Known exploited: yes, in CISA KEV since 2026-01-22; CISA due date 2026-02-12
- EPSS: 48.87%
- Unvetted proof-of-concept code on GitHub: 7 GitHub proofs of concept · 1 Nuclei template (first 2025-12-30)
- CISA SSVC: exploitation active, automatable no, technical impact total (assessed 2026-01-23)
- Weakness: CWE-98
- Published: 2025-12-22

## Affected

- synacor:zimbra_collaboration_suite

## References

- [other] https://wiki.zimbra.com/wiki/Security_Center
- [other] https://wiki.zimbra.com/wiki/Zimbra_Responsible_Disclosure_Policy
- [other] https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-68645

---
Summary, impact and action are written by the vulneraibility.com AI analysis pipeline from the CVE record, NVD, CISA and FIRST data; verify against the references.