An issue was discovered in Zimbra Collaboration (ZCS) 8.8.15 and 9.0 and 10.0 and 10.1. A Cross-Site Scripting (XSS) vulnerability in the Zimbra Classic UI allows attackers to execute arbitrary JavaScript within the user's session, potentially leading to unauthorized access to sensitive information. This issue arises from insufficient sanitization of HTML content, specifically involving crafted tag structures and attribute values that include an @import directive and other script injection vectors. The vulnerability is triggered when a user views a crafted e-mail message in the Classic UI, requiring no additional user interaction.
{
"versions": [
{
"introduced": "10.1.0"
},
{
"fixed": "10.1.4"
},
{
"introduced": "0"
},
{
"last_affected": "8.8.15-NA"
},
{
"introduced": "0"
},
{
"last_affected": "8.8.15-p1"
},
{
"introduced": "0"
},
{
"last_affected": "8.8.15-p11"
},
{
"introduced": "0"
},
{
"last_affected": "8.8.15-p20"
},
{
"introduced": "0"
},
{
"last_affected": "8.8.15-p26"
},
{
"introduced": "0"
},
{
"last_affected": "8.8.15-p3"
},
{
"introduced": "0"
},
{
"last_affected": "8.8.15-p30"
},
{
"introduced": "0"
},
{
"last_affected": "8.8.15-p31"
},
{
"introduced": "0"
},
{
"last_affected": "8.8.15-p32"
},
{
"introduced": "0"
},
{
"last_affected": "8.8.15-p33"
},
{
"introduced": "0"
},
{
"last_affected": "8.8.15-p34"
},
{
"introduced": "0"
},
{
"last_affected": "8.8.15-p35"
},
{
"introduced": "0"
},
{
"last_affected": "8.8.15-p40"
},
{
"introduced": "0"
},
{
"last_affected": "8.8.15-p43"
},
{
"introduced": "0"
},
{
"last_affected": "8.8.15-p44"
},
{
"introduced": "0"
},
{
"last_affected": "8.8.15-p45"
},
{
"introduced": "0"
},
{
"last_affected": "8.8.15-p5"
},
{
"introduced": "0"
},
{
"last_affected": "9.0.0-NA"
},
{
"introduced": "0"
},
{
"last_affected": "9.0.0-p1"
},
{
"introduced": "0"
},
{
"last_affected": "9.0.0-p19"
},
{
"introduced": "0"
},
{
"last_affected": "9.0.0-p20"
},
{
"introduced": "0"
},
{
"last_affected": "9.0.0-p23"
},
{
"introduced": "0"
},
{
"last_affected": "9.0.0-p25"
},
{
"introduced": "0"
},
{
"last_affected": "9.0.0-p26"
},
{
"introduced": "0"
},
{
"last_affected": "9.0.0-p27"
},
{
"introduced": "0"
},
{
"last_affected": "9.0.0-p28"
},
{
"introduced": "0"
},
{
"last_affected": "9.0.0-p33"
},
{
"introduced": "0"
},
{
"last_affected": "9.0.0-p36"
},
{
"introduced": "0"
},
{
"last_affected": "9.0.0-p37"
},
{
"introduced": "0"
},
{
"last_affected": "9.0.0-p38"
},
{
"introduced": "0"
},
{
"last_affected": "9.0.0-p4"
},
{
"introduced": "0"
},
{
"last_affected": "9.0.0-p7"
}
]
}{
"versions": [
{
"introduced": "10.0.0"
},
{
"fixed": "10.0.12"
},
{
"introduced": "0"
},
{
"last_affected": "8.8.15-p10"
},
{
"introduced": "0"
},
{
"last_affected": "8.8.15-p12"
},
{
"introduced": "0"
},
{
"last_affected": "8.8.15-p13"
},
{
"introduced": "0"
},
{
"last_affected": "8.8.15-p14"
},
{
"introduced": "0"
},
{
"last_affected": "8.8.15-p15"
},
{
"introduced": "0"
},
{
"last_affected": "8.8.15-p16"
},
{
"introduced": "0"
},
{
"last_affected": "8.8.15-p17"
},
{
"introduced": "0"
},
{
"last_affected": "8.8.15-p18"
},
{
"introduced": "0"
},
{
"last_affected": "8.8.15-p2"
},
{
"introduced": "0"
},
{
"last_affected": "8.8.15-p23"
},
{
"introduced": "0"
},
{
"last_affected": "8.8.15-p24"
},
{
"introduced": "0"
},
{
"last_affected": "8.8.15-p25"
},
{
"introduced": "0"
},
{
"last_affected": "8.8.15-p27"
},
{
"introduced": "0"
},
{
"last_affected": "8.8.15-p29"
},
{
"introduced": "0"
},
{
"last_affected": "8.8.15-p31\\.1"
},
{
"introduced": "0"
},
{
"last_affected": "8.8.15-p36"
},
{
"introduced": "0"
},
{
"last_affected": "8.8.15-p37"
},
{
"introduced": "0"
},
{
"last_affected": "8.8.15-p39"
},
{
"introduced": "0"
},
{
"last_affected": "8.8.15-p4"
},
{
"introduced": "0"
},
{
"last_affected": "8.8.15-p41"
},
{
"introduced": "0"
},
{
"last_affected": "8.8.15-p46"
},
{
"introduced": "0"
},
{
"last_affected": "8.8.15-p6"
},
{
"introduced": "0"
},
{
"last_affected": "8.8.15-p7"
},
{
"introduced": "0"
},
{
"last_affected": "8.8.15-p8"
},
{
"introduced": "0"
},
{
"last_affected": "8.8.15-p9"
},
{
"introduced": "0"
},
{
"last_affected": "9.0.0-p10"
},
{
"introduced": "0"
},
{
"last_affected": "9.0.0-p11"
},
{
"introduced": "0"
},
{
"last_affected": "9.0.0-p13"
},
{
"introduced": "0"
},
{
"last_affected": "9.0.0-p14"
},
{
"introduced": "0"
},
{
"last_affected": "9.0.0-p16"
},
{
"introduced": "0"
},
{
"last_affected": "9.0.0-p17"
},
{
"introduced": "0"
},
{
"last_affected": "9.0.0-p18"
},
{
"introduced": "0"
},
{
"last_affected": "9.0.0-p2"
},
{
"introduced": "0"
},
{
"last_affected": "9.0.0-p22"
},
{
"introduced": "0"
},
{
"last_affected": "9.0.0-p24"
},
{
"introduced": "0"
},
{
"last_affected": "9.0.0-p24\\.1"
},
{
"introduced": "0"
},
{
"last_affected": "9.0.0-p29"
},
{
"introduced": "0"
},
{
"last_affected": "9.0.0-p3"
},
{
"introduced": "0"
},
{
"last_affected": "9.0.0-p30"
},
{
"introduced": "0"
},
{
"last_affected": "9.0.0-p32"
},
{
"introduced": "0"
},
{
"last_affected": "9.0.0-p34"
},
{
"introduced": "0"
},
{
"last_affected": "9.0.0-p39"
},
{
"introduced": "0"
},
{
"last_affected": "9.0.0-p40"
},
{
"introduced": "0"
},
{
"last_affected": "9.0.0-p41"
},
{
"introduced": "0"
},
{
"last_affected": "9.0.0-p5"
},
{
"introduced": "0"
},
{
"last_affected": "9.0.0-p6"
},
{
"introduced": "0"
},
{
"last_affected": "9.0.0-p8"
},
{
"introduced": "0"
},
{
"last_affected": "9.0.0-p9"
}
]
}[
{
"events": [
{
"introduced": "0"
},
{
"last_affected": "8.8.15-p19"
}
]
},
{
"events": [
{
"introduced": "0"
},
{
"last_affected": "8.8.15-p22"
}
]
},
{
"events": [
{
"introduced": "0"
},
{
"last_affected": "8.8.15-p28"
}
]
},
{
"events": [
{
"introduced": "0"
},
{
"last_affected": "8.8.15-p38"
}
]
},
{
"events": [
{
"introduced": "0"
},
{
"last_affected": "8.8.15-p42"
}
]
},
{
"events": [
{
"introduced": "0"
},
{
"last_affected": "9.0.0-p12"
}
]
},
{
"events": [
{
"introduced": "0"
},
{
"last_affected": "9.0.0-p15"
}
]
},
{
"events": [
{
"introduced": "0"
},
{
"last_affected": "9.0.0-p21"
}
]
},
{
"events": [
{
"introduced": "0"
},
{
"last_affected": "9.0.0-p31"
}
]
},
{
"events": [
{
"introduced": "0"
},
{
"last_affected": "9.0.0-p35"
}
]
},
{
"events": [
{
"introduced": "0"
},
{
"last_affected": "9.0.0-p42"
}
]
}
]
[
{
"deprecated": false,
"signature_version": "v1",
"id": "CVE-2025-48700-2802cfab",
"digest": {
"length": 2910.0,
"function_hash": "250239021129922179859369307689305685860"
},
"source": "https://github.com/zimbra/zm-mailbox/commit/36b0176b086d3ced0cd751ec0aca4d9869574496",
"signature_type": "Function",
"target": {
"file": "store/src/java/com/zimbra/cs/service/account/ChangePassword.java",
"function": "handle"
}
},
{
"deprecated": false,
"signature_version": "v1",
"id": "CVE-2025-48700-8d17d1e8",
"digest": {
"line_hashes": [
"100352541356968744543459554936932541435",
"34980778564753151690669805825885263298",
"163615395104885010895005793672519100036",
"324766885195200298088869019113793247780"
],
"threshold": 0.9
},
"source": "https://github.com/zimbra/zm-mailbox/commit/36b0176b086d3ced0cd751ec0aca4d9869574496",
"signature_type": "Line",
"target": {
"file": "store/src/java/com/zimbra/cs/service/account/ChangePassword.java"
}
}
]
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-48700.json"
"2026-04-12T16:41:26Z"