CVE-2026-93633: Zimbra Collaboration Suite Briefcase CSS Sanitization Bypass via Non-ASCII Stylesheet Characters
A CSS sanitization vulnerability in Zimbra Collaboration Suite (ZCS) allows an authenticated user with Briefcase access to publish a document that displays attacker-controlled content under the Zimbra origin. When processing a stylesheet containing non-ASCII characters, DefangFilter appends the final ASCII segment without sanitizing it. HTML stored as application/x-zimbra-doc can therefore retain CSS URL references that the normal sanitizer removes. An attacker can share a crafted document that loads external resources and displays a credential-collection form using Zimbra's own visual assets. Exploitation requires the victim to open the document in a browser that renders the content type inline; credential theft additionally requires form submission. ZCS 10.1.16 and 10.1.20 are affected.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue, and who is exposed to the shared content?
An attacker needs an authenticated Zimbra account with Briefcase access to publish the crafted document. Users are exposed when they open that shared document in a browser that renders application/x-zimbra-doc inline.
What user interaction is required for credential theft?
The victim must open the crafted document, and credential theft requires the victim to submit the attacker-controlled form. The document can use Zimbra visual assets while displaying attacker-controlled content under the Zimbra origin.
Which ZCS versions are identified as affected?
ZCS 10.1.16 and 10.1.20 are affected.