CVE-2025-68645

🗓️ 22 Dec 2025 00:00:00Reported by mitreType

cve🔗 web.nvd.nist.gov📰️ 9 Media mentions👁 209 Views🌐 WEB

CVE-2025-68645: LFI in Zimbra Webmail Classic UI on ZCS 10.0/10.1 via RestFilter, allows unauthenticated file inclusion from WebRoot.

Reporter	Title	Published	Views	Family All 21
GithubExploit	Exploit for PHP Remote File Inclusion in Synacor Zimbra_Collaboration_Suite	10 Feb 202604:28	–	githubexploit
GithubExploit	Exploit for PHP Remote File Inclusion in Synacor Zimbra_Collaboration_Suite	21 Feb 202614:07	–	githubexploit
GithubExploit	Exploit for CVE-2025-68645	1 Jan 202610:29	–	githubexploit
GithubExploit	Exploit for PHP Remote File Inclusion in Synacor Zimbra_Collaboration_Suite	6 May 202607:21	–	githubexploit
BDU FSTEC	The vulnerability of the RestFilter component of the web interface for managing the Zimbra Collaboration Suite (ZCS) enterprise email management system allows a hacker to execute arbitrary code.	26 Dec 202500:00	–	bdu_fstec
Circl	CVE-2025-68645	25 Dec 202521:00	–	circl
CISA KEV Catalog	Synacor Zimbra Collaboration Suite (ZCS) PHP Remote File Inclusion Vulnerability	22 Jan 202600:00	–	cisa_kev
CISA	CISA Adds Four Known Exploited Vulnerabilities to Catalog	22 Jan 202612:00	–	cisa
CNNVD	Zimbra Collaboration 安全漏洞	22 Dec 202500:00	–	cnnvd
Cvelist	CVE-2025-68645	22 Dec 202500:00	–	cvelist

NVD

Node

Source	Link
wiki	www.wiki.zimbra.com/wiki/Zimbra_Responsible_Disclosure_Policy
wiki	www.wiki.zimbra.com/wiki/Security_Center
cisa	www.cisa.gov/known-exploited-vulnerabilities-catalog

Parameter	Position	Path	Description	CWE
javax.servlet.include.servlet_path	query param	/h/rest	LFI via RestFilter parameter manipulation allowing inclusion of arbitrary files from WebRoot	CWE-98
javax.servlet.include.servlet_path	query param	/h/printcalendar	LFI PoC path using printcalendar endpoint with servlet_path parameter to include WebRoot files	CWE-98
javax.servlet.include.servlet_path	query param	/h/printconversations	LFI vector using printconversations endpoint with servlet_path parameter to include WebRoot files	CWE-98

17 Jun 2026 09:59Current

6.8Medium risk

Vulners AI Score6.8

CVSS 3.18.8

EPSS0.31769

SSVC