CVE-2026-115785: Zimbra Collaboration Suite Data Source Test SMTP Command Injection via Unsanitized Email Address
An SMTP command injection vulnerability in the data-source testing functionality of Zimbra Collaboration Suite (ZCS) allows an ordinary authenticated user with account options enabled to inject CR/LF into the emailAddress inserted into an SMTP envelope command by a JSON SOAP request. After a successful preliminary POP3 or IMAP login, Zimbra sends the injected commands to the selected SMTP service. If that service accepts the pipelined transaction, the attacker can submit mail with attacker-selected recipients, headers and body content without victim interaction. The vulnerable command-construction path is present in ZCS 10.1.16 and 10.1.20.
Affected Software
Event History
Frequently Asked Questions
Which users can exploit this issue?
An ordinary authenticated ZCS user can exploit it if account options are enabled. No victim interaction is required.
What conditions must be met for exploitation to succeed?
The attacker must inject CR/LF through the emailAddress field in a JSON SOAP request and first complete a preliminary POP3 or IMAP login. The selected SMTP service must also accept the resulting pipelined SMTP transaction.
Which deployments are known to contain the vulnerable command path?
The vulnerable command-construction path is present in ZCS 10.1.16 and 10.1.20.
What can a successful attacker do?
A successful attacker can cause the selected SMTP service to accept attacker-injected commands and submit email with attacker-selected recipients, headers, and body content.