Zimbra Collaboration LFI (CVE-2025-68645)

Zimbra Collaboration contains a local file inclusion vulnerability caused by improper handling of user-supplied input in a REST servlet component. Due to insufficient validation of request parameters, an unauthenticated remote attacker can craft requests that force the application to include arbitrary files from within the web root directory.

An attacker can exploit this vulnerability to read arbitrary files from within the web root directory, potentially exposing sensitive information such as configuration files, application source code, database credentials, or other confidential data. This information disclosure could enable further attacks, including privilege escalation, unauthorized access to backend systems, or complete system compromise. The vulnerability requires no authentication and can be exploited remotely over the network.

Upgrade Zimbra Collaboration Suite to the latest patched version and ensure all security updates are applied regularly.