CVE-2026-93643: Zimbra Collaboration Suite OnlyOffice Integration Path Traversal Leading to Remote Code Execution via Unauthenticated /downloadas Request
When OnlyOffice/Document Editing is available, an unauthenticated remote attacker with access to an existing supported public Briefcase document can abuse unsigned save fields to perform path-traversal writes and execute commands as zimbra.
Affected Software
Event History
Frequently Asked Questions
What conditions must be present for exploitation?
OnlyOffice/Document Editing must be available, and the attacker must have access to an existing supported public Briefcase document. The vulnerable request is unauthenticated, so no Zimbra account credentials are required.
What level of access can an attacker obtain?
Successful exploitation can result in command execution as the zimbra user. The described impact includes high confidentiality, integrity, and availability impact.
Are deployments without public Briefcase documents exposed through the described attack path?
The described exploitation requires access to an existing supported public Briefcase document. The provided information does not establish exploitability when no such public document is accessible.
What component should be prioritized for mitigation?
Prioritize systems where OnlyOffice/Document Editing is available and public Briefcase documents are accessible. If immediate patching is not possible, restricting access to public Briefcase documents or disabling the affected document-editing availability would address prerequisites described for the attack.