Lucene search
K
Catalog
Vendors
Products
Timeline
Vulnerabilities
Sources
Documentation
Blog
Glossary
FAQ
Brand assets
Assessment
Agents dashboard
Agent Scanning
API Scanning
Assessment API
Alerts
Email notifications
Webhook notifications
Alerts API
SBOM package analysis
API Reference
Support
Settings
Sign in

CVE-2025-68645

🗓️ 22 Dec 2025 00:00:00Reported by mitreType 
cve
 cve🔗 web.nvd.nist.gov📰️ 9 Media mentions👁 107 Views🌐 WEB

CVE-2025-68645: LFI in Zimbra Webmail Classic UI on ZCS 10.0/10.1 via RestFilter, allows unauthenticated file inclusion from WebRoot.

Related
Detection
Refs
Paths
Social
ReporterTitlePublishedViews
Family
GithubExploit		Exploit for PHP Remote File Inclusion in Synacor Zimbra_Collaboration_Suite
10 Feb 202604:28
–githubexploit
GithubExploit		Exploit for PHP Remote File Inclusion in Synacor Zimbra_Collaboration_Suite
21 Feb 202614:07
–githubexploit
GithubExploit		Exploit for CVE-2025-68645
1 Jan 202610:29
–githubexploit
GithubExploit		Exploit for PHP Remote File Inclusion in Synacor Zimbra_Collaboration_Suite
6 May 202607:21
–githubexploit
BDU FSTEC		The vulnerability of the RestFilter component of the web interface for managing the Zimbra Collaboration Suite (ZCS) enterprise email management system allows a hacker to execute arbitrary code.
26 Dec 202500:00
–bdu_fstec
Circl		CVE-2025-68645
25 Dec 202521:00
–circl
CISA KEV Catalog		Synacor Zimbra Collaboration Suite (ZCS) PHP Remote File Inclusion Vulnerability
22 Jan 202600:00
–cisa_kev
CISA		 CISA Adds Four Known Exploited Vulnerabilities to Catalog
22 Jan 202612:00
–cisa
CNNVD		Zimbra Collaboration 安全漏洞
22 Dec 202500:00
–cnnvd
Cvelist		CVE-2025-68645
22 Dec 202500:00
–cvelist
Rows per page
NVD
Node
synacorzimbra_collaboration_suiteRange10.0.0–10.0.18
OR
synacorzimbra_collaboration_suiteRange10.1.0–10.1.13
ParameterPositionPathDescriptionCWE
javax.servlet.include.servlet_pathquery paramh/restLFI via RestFilter parameter manipulation allowing inclusion of internal filesCWE-98
javax.servlet.include.servlet_pathquery paramh/printconversationsLFI exposure through printconversations endpoint with crafted include pathCWE-98
javax.servlet.include.servlet_pathquery paramh/printcalendarLFI via printcalendar endpoint exploiting javax.servlet.include.servlet_pathCWE-98

Data

Build on a solid foundation with Vulners data

We provide the essential building blocks for cybersecurity solutions with comprehensive, structured, and constantly updated vulnerability and exploits data

Api

Power your application with Vulners API

The Vulners REST API offers reliable, high-performance access to vulnerability intelligence, with 99.9% SLA uptime and CDN-backed data delivery for seamless global access

App

Assess and manage vulnerabilities with Vulners tools

Built on top of Vulners' database and SDK, end-user solutions give security professionals and developers lightweight and powerful tools for vulnerability remediation

Book a live demo
17 Jun 2026 09:59Current
6.8Medium risk
Vulners AI Score6.8
CVSS 3.18.8
EPSS0.31769
SSVC
CWE-98In Wild
local file inclusionZimbra CollaborationWebmail Classic UIRestFilter servletWebRoot directory
107