CVE-2026-93630

A hostname canonicalization vulnerability in the email HTML sanitizers of Zimbra Collaboration Suite ZCS allows an unauthenticated sender to bypass the restriction on forms that target the Zimbra host. DefangFilter and the OWASP ActionAttributePolicy compare the form-action hostname with the...

CVE-2026-93630

The Zimbra Collaboration Suite (ZCS) versions 10.1.16 and 10.1.21 are vulnerable to a hostname canonicalization issue in their email HTML sanitizers. The DefangFilter and OWASP ActionAttributePolicy components fail to properly handle percent-encoded hostnames, comparing them against the request h...

EUVD-2026-108971

A hostname canonicalization vulnerability in the email HTML sanitizers of Zimbra Collaboration Suite ZCS allows an unauthenticated sender to bypass the restriction on forms that target the Zimbra host. DefangFilter and the OWASP ActionAttributePolicy compare the form-action hostname with the...