CVE-2022-41352
Synacor Zimbra Collaboration Suite (ZCS) Arbitrary File Upload Vulnerability
Published Sep 25, 2022 · updated Sep 9, 2026 · synacor zimbra collaboration suite
An issue was discovered in Zimbra Collaboration (ZCS) 8.8.15 and 9.0. An attacker can upload arbitrary files through amavis via a cpio loophole (extraction to /opt/zimbra/jetty/webapps/zimbra/public) that can lead to incorrect access to any other user accounts. Zimbra recommends pax over cpio. Also, pax is in the prerequisites of Zimbra on Ubuntu; however, pax is no longer part of a default Red Hat installation after RHEL 6 (or CentOS 6). Once pax is installed, amavis automatically prefers it over cpio.
Timeline
Detection, updates, and resolution for this record.
Sep 25, 2022 · Catalog
Detected
An issue was discovered in Zimbra Collaboration (ZCS) 8.8.15 and 9.0. An attacker can upload arbitrary files through amavis via a cpio loophole (extraction to /opt/zimbra/jetty/webapps/zimbra/public) that can lead to incorrect access to any other user accounts. Zimbra recommends pax over cpio. Also, pax is in the prerequisites of Zimbra on Ubuntu; however, pax is no longer part of a default Red Ha
Oct 20, 2022 · CISA KEV
Known exploited
Apply updates per vendor instructions.
Nov 10, 2022 · CISA KEV
Remediation due
Apply updates per vendor instructions.
Sep 9, 2026 · Catalog
Updated
An issue was discovered in Zimbra Collaboration (ZCS) 8.8.15 and 9.0. An attacker can upload arbitrary files through amavis via a cpio loophole (extraction to /opt/zimbra/jetty/webapps/zimbra/public) that can lead to incorrect access to any other user accounts. Zimbra recommends pax over cpio. Also, pax is in the prerequisites of Zimbra on Ubuntu; however, pax is no longer part of a default Red Ha
Required action
Apply updates per vendor instructions.
CISA due date Nov 10, 2022
Affected
- cpe synacor/zimbra collaboration suite8.8.15
- cpe synacor/zimbra collaboration suite9.0.0
- vendor Synacor Zimbra Collaboration Suite (ZCS)version unspecified
Sources
- CISA KEVCVE-2022-41352
Synacor Zimbra Collaboration Suite (ZCS) allows an attacker to upload arbitrary files using cpio package to gain incorrect access to any other user accounts.
cisa.gov - CVE.orgCVE-2022-41352
Official CVE identifier
cve.org - FIRST EPSSCVE-2022-41352
30-day exploitation probability 95.5%
first.org - Metasploit Modulesexploit_linux/http/zimbra_cpio_cve_2022_41352
Public module reference (excellent). Module source is not copied into this catalog.
rapid7.com - NIST NVDCVE-2022-41352
An issue was discovered in Zimbra Collaboration (ZCS) 8.8.15 and 9.0. An attacker can upload arbitrary files through amavis via a cpio loophole (extraction to /opt/zimbra/jetty/webapps/zimbra/public) that can lead to incorrect access to any other user accounts. Zimbra recommends
nvd.nist.gov