CVE-2022-27925

This bug is like giving a staff member a “file return” box (the ZIP import) and letting them unpack it into any location on the building—not just where it’s supposed to go. Because it’s an administrator-only feature, the danger is that if an attacker gets an administrator account, they can place files on your server to install malware or take over the system.

This matters if your business runs Zimbra Collaboration Suite and your system is on Zimbra Collaboration Suite 8.8.15 or 9.0. The risky path requires an authenticated administrator user using the mboximport ZIP handling, so it becomes a real concern when admin accounts are reachable or could be stolen. Because CISA KEV says it’s been used in ransomware campaigns, assume attackers will target internet-facing setups where they can obtain administrator access.

This is RED because it’s confirmed in CISA’s KEV and has been used in ransomware campaigns. Attackers have a known way to turn the ZIP import into arbitrary file placement, which can enable malware and full compromise after obtaining admin access.