CVE-2026-73574 - In Zimbra Collaboration before 10.1.17, a local file inclusion (LFI) vulnerability exists in the Zimbra Classic Web Client due to improper validation of the fu request parameter. An unauthenticated attacker can exploit this vulnerability by supplying a crafted path, potentially allowing unauthorized disclosure of protected files, such as WEB-INF/web.xml, within the web application directory. This occurs in the Forward servlet. - 漏洞详情

漏洞编号：CVE-2026-73574

风险等级：低危

漏洞来源：CVE

CVE 编号：CVE-2026-73574

CNNVD 编号：-

厂商/产品：synacor / zimbra_collaboration_suite

影响范围：cpe:2.3:a:synacor:zimbra_collaboration_suite:*:*:*:*:*:*:*:*

CWE：CWE-669

发布/更新时间：2026-08-13 / 2026-08-28

漏洞描述

In Zimbra Collaboration before 10.1.17, a local file inclusion (LFI) vulnerability exists in the Zimbra Classic Web Client due to improper validation of the fu request parameter. An unauthenticated attacker can exploit this vulnerability by supplying a crafted path, potentially allowing unauthorized disclosure of protected files, such as WEB-INF/web.xml, within the web application directory. This occurs in the Forward servlet.

漏洞描述

相关链接

相关漏洞