CVE-2025-48700

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2025-48700
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-48700.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2025-48700
Published
2025-06-23T00:00:00Z
Modified
2026-07-22T04:02:04.978717Z
Severity
  • 6.1 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N CVSS Calculator
Summary
[none]
Details

An issue was discovered in Zimbra Collaboration (ZCS) 8.8.15 and 9.0 and 10.0 and 10.1. A Cross-Site Scripting (XSS) vulnerability in the Zimbra Classic UI allows attackers to execute arbitrary JavaScript within the user's session, potentially leading to unauthorized access to sensitive information. This issue arises from insufficient sanitization of HTML content, specifically involving crafted tag structures and attribute values that include an @import directive and other script injection vectors. The vulnerability is triggered when a user views a crafted e-mail message in the Classic UI, requiring no additional user interaction.

Database specific 
{
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/48xxx/CVE-2025-48700.json",
    "cna_assigner": "mitre"
}
References

Affected packages

Git
github.com/zimbra/zm-build

Affected ranges

Type
GIT
Repo
https://github.com/zimbra/zm-build
Events
Introduced
52b539ef205db233bfd8116e8130e27735b4153c
Fixed
16fcfbde0910368571419d9becd0401a95af6e7f
Introduced
ac6081fa002b1511e926aba37740d2b6c20f3f43
Last affected
bcb978ccc354d99d843725886083e321759b6765
Database specific 
{
    "cpe": [
        "cpe:2.3:a:synacor:zimbra_collaboration_suite:*:*:*:*:*:*:*:*",
        "cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:-:*:*:*:*:*:*",
        "cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:p1:*:*:*:*:*:*",
        "cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:p11:*:*:*:*:*:*",
        "cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:p20:*:*:*:*:*:*",
        "cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:p26:*:*:*:*:*:*",
        "cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:p3:*:*:*:*:*:*",
        "cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:p30:*:*:*:*:*:*",
        "cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:p31:*:*:*:*:*:*",
        "cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:p32:*:*:*:*:*:*",
        "cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:p33:*:*:*:*:*:*",
        "cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:p34:*:*:*:*:*:*",
        "cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:p35:*:*:*:*:*:*",
        "cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:p40:*:*:*:*:*:*",
        "cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:p43:*:*:*:*:*:*",
        "cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:p44:*:*:*:*:*:*",
        "cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:p45:*:*:*:*:*:*",
        "cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:p5:*:*:*:*:*:*",
        "cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:-:*:*:*:*:*:*",
        "cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p1:*:*:*:*:*:*",
        "cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p19:*:*:*:*:*:*",
        "cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p20:*:*:*:*:*:*",
        "cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p23:*:*:*:*:*:*",
        "cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p25:*:*:*:*:*:*",
        "cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p26:*:*:*:*:*:*",
        "cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p27:*:*:*:*:*:*",
        "cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p28:*:*:*:*:*:*",
        "cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p33:*:*:*:*:*:*",
        "cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p36:*:*:*:*:*:*",
        "cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p37:*:*:*:*:*:*",
        "cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p38:*:*:*:*:*:*",
        "cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p4:*:*:*:*:*:*",
        "cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p7:*:*:*:*:*:*"
    ],
    "source": [
        "CPE_RANGE",
        "CPE_STRING"
    ],
    "extracted_events": [
        {
            "introduced": "10.1.0"
        },
        {
            "fixed": "10.1.4"
        },
        {
            "introduced": "8.8.15-NA"
        },
        {
            "last_affected": "8.8.15-NA"
        },
        {
            "introduced": "8.8.15-p1"
        },
        {
            "last_affected": "8.8.15-p1"
        },
        {
            "introduced": "8.8.15-p11"
        },
        {
            "last_affected": "8.8.15-p11"
        },
        {
            "introduced": "8.8.15-p20"
        },
        {
            "last_affected": "8.8.15-p20"
        },
        {
            "introduced": "8.8.15-p26"
        },
        {
            "last_affected": "8.8.15-p26"
        },
        {
            "introduced": "8.8.15-p3"
        },
        {
            "last_affected": "8.8.15-p3"
        },
        {
            "introduced": "8.8.15-p30"
        },
        {
            "last_affected": "8.8.15-p30"
        },
        {
            "introduced": "8.8.15-p31"
        },
        {
            "last_affected": "8.8.15-p31"
        },
        {
            "introduced": "8.8.15-p32"
        },
        {
            "last_affected": "8.8.15-p32"
        },
        {
            "introduced": "8.8.15-p33"
        },
        {
            "last_affected": "8.8.15-p33"
        },
        {
            "introduced": "8.8.15-p34"
        },
        {
            "last_affected": "8.8.15-p34"
        },
        {
            "introduced": "8.8.15-p35"
        },
        {
            "last_affected": "8.8.15-p35"
        },
        {
            "introduced": "8.8.15-p40"
        },
        {
            "last_affected": "8.8.15-p40"
        },
        {
            "introduced": "8.8.15-p43"
        },
        {
            "last_affected": "8.8.15-p43"
        },
        {
            "introduced": "8.8.15-p44"
        },
        {
            "last_affected": "8.8.15-p44"
        },
        {
            "introduced": "8.8.15-p45"
        },
        {
            "last_affected": "8.8.15-p45"
        },
        {
            "introduced": "8.8.15-p5"
        },
        {
            "last_affected": "8.8.15-p5"
        },
        {
            "introduced": "9.0.0-NA"
        },
        {
            "last_affected": "9.0.0-NA"
        },
        {
            "introduced": "9.0.0-p1"
        },
        {
            "last_affected": "9.0.0-p1"
        },
        {
            "introduced": "9.0.0-p19"
        },
        {
            "last_affected": "9.0.0-p19"
        },
        {
            "introduced": "9.0.0-p20"
        },
        {
            "last_affected": "9.0.0-p20"
        },
        {
            "introduced": "9.0.0-p23"
        },
        {
            "last_affected": "9.0.0-p23"
        },
        {
            "introduced": "9.0.0-p25"
        },
        {
            "last_affected": "9.0.0-p25"
        },
        {
            "introduced": "9.0.0-p26"
        },
        {
            "last_affected": "9.0.0-p26"
        },
        {
            "introduced": "9.0.0-p27"
        },
        {
            "last_affected": "9.0.0-p27"
        },
        {
            "introduced": "9.0.0-p28"
        },
        {
            "last_affected": "9.0.0-p28"
        },
        {
            "introduced": "9.0.0-p33"
        },
        {
            "last_affected": "9.0.0-p33"
        },
        {
            "introduced": "9.0.0-p36"
        },
        {
            "last_affected": "9.0.0-p36"
        },
        {
            "introduced": "9.0.0-p37"
        },
        {
            "last_affected": "9.0.0-p37"
        },
        {
            "introduced": "9.0.0-p38"
        },
        {
            "last_affected": "9.0.0-p38"
        },
        {
            "introduced": "9.0.0-p4"
        },
        {
            "last_affected": "9.0.0-p4"
        },
        {
            "introduced": "9.0.0-p7"
        },
        {
            "last_affected": "9.0.0-p7"
        }
    ]
}

Affected versions

10.*
10.1.0
10.1.1
8.*
8.8.15-NA
8.8.15-p1
8.8.15-p20
8.8.15-p26
8.8.15-p3
8.8.15-p30
8.8.15-p31
8.8.15-p32
8.8.15-p33
8.8.15-p34
8.8.15-p35
8.8.15-p40
8.8.15-p43
8.8.15-p44
8.8.15-p45
8.8.15-p5
9.*
9.0.0-NA
9.0.0-p1
9.0.0-p20
9.0.0-p23
9.0.0-p25
9.0.0-p26
9.0.0-p27
9.0.0-p28
9.0.0-p33
9.0.0-p36
9.0.0-p37
9.0.0-p38
9.0.0-p4
9.0.0-p7

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-48700.json"
github.com/zimbra/zm-mailbox

Affected ranges

Type
GIT
Repo
https://github.com/zimbra/zm-mailbox
Events
Introduced
8033bd1ec9d7211c2eb5fa71aeb3b4073a8dc160
Fixed
36b0176b086d3ced0cd751ec0aca4d9869574496
Introduced
de2f187263204c5edbcd64ab4aad155367f27eef
Fixed
02deeb6294c2327768a7177124ea3bab2a56e56c
Introduced
d30e647f21ecef5490f21facf2e06e228b44a36e
Last affected
10b7ff251aee6f4770ad75377a1f81491ad5bdb9
Database specific 
{
    "cpe": [
        "cpe:2.3:a:synacor:zimbra_collaboration_suite:*:*:*:*:*:*:*:*",
        "cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:-:*:*:*:*:*:*",
        "cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:p1:*:*:*:*:*:*",
        "cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:p10:*:*:*:*:*:*",
        "cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:p11:*:*:*:*:*:*",
        "cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:p12:*:*:*:*:*:*",
        "cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:p13:*:*:*:*:*:*",
        "cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:p14:*:*:*:*:*:*",
        "cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:p15:*:*:*:*:*:*",
        "cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:p16:*:*:*:*:*:*",
        "cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:p17:*:*:*:*:*:*",
        "cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:p18:*:*:*:*:*:*",
        "cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:p2:*:*:*:*:*:*",
        "cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:p20:*:*:*:*:*:*",
        "cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:p23:*:*:*:*:*:*",
        "cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:p24:*:*:*:*:*:*",
        "cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:p25:*:*:*:*:*:*",
        "cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:p26:*:*:*:*:*:*",
        "cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:p27:*:*:*:*:*:*",
        "cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:p29:*:*:*:*:*:*",
        "cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:p3:*:*:*:*:*:*",
        "cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:p30:*:*:*:*:*:*",
        "cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:p31:*:*:*:*:*:*",
        "cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:p31.1:*:*:*:*:*:*",
        "cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:p32:*:*:*:*:*:*",
        "cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:p33:*:*:*:*:*:*",
        "cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:p34:*:*:*:*:*:*",
        "cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:p35:*:*:*:*:*:*",
        "cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:p36:*:*:*:*:*:*",
        "cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:p37:*:*:*:*:*:*",
        "cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:p39:*:*:*:*:*:*",
        "cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:p4:*:*:*:*:*:*",
        "cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:p40:*:*:*:*:*:*",
        "cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:p41:*:*:*:*:*:*",
        "cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:p45:*:*:*:*:*:*",
        "cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:p46:*:*:*:*:*:*",
        "cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:p5:*:*:*:*:*:*",
        "cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:p6:*:*:*:*:*:*",
        "cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:p7:*:*:*:*:*:*",
        "cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:p8:*:*:*:*:*:*",
        "cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:p9:*:*:*:*:*:*",
        "cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:-:*:*:*:*:*:*",
        "cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p1:*:*:*:*:*:*",
        "cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p10:*:*:*:*:*:*",
        "cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p11:*:*:*:*:*:*",
        "cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p13:*:*:*:*:*:*",
        "cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p14:*:*:*:*:*:*",
        "cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p16:*:*:*:*:*:*",
        "cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p17:*:*:*:*:*:*",
        "cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p18:*:*:*:*:*:*",
        "cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p19:*:*:*:*:*:*",
        "cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p2:*:*:*:*:*:*",
        "cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p20:*:*:*:*:*:*",
        "cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p22:*:*:*:*:*:*",
        "cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p23:*:*:*:*:*:*",
        "cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p24:*:*:*:*:*:*",
        "cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p24.1:*:*:*:*:*:*",
        "cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p25:*:*:*:*:*:*",
        "cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p26:*:*:*:*:*:*",
        "cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p27:*:*:*:*:*:*",
        "cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p28:*:*:*:*:*:*",
        "cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p29:*:*:*:*:*:*",
        "cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p3:*:*:*:*:*:*",
        "cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p30:*:*:*:*:*:*",
        "cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p32:*:*:*:*:*:*",
        "cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p33:*:*:*:*:*:*",
        "cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p34:*:*:*:*:*:*",
        "cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p38:*:*:*:*:*:*",
        "cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p39:*:*:*:*:*:*",
        "cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p4:*:*:*:*:*:*",
        "cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p40:*:*:*:*:*:*",
        "cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p41:*:*:*:*:*:*",
        "cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p5:*:*:*:*:*:*",
        "cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p6:*:*:*:*:*:*",
        "cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p7:*:*:*:*:*:*",
        "cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p8:*:*:*:*:*:*",
        "cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p9:*:*:*:*:*:*"
    ],
    "source": [
        "CPE_RANGE",
        "CPE_STRING"
    ],
    "extracted_events": [
        {
            "introduced": "10.0.0"
        },
        {
            "fixed": "10.0.12"
        },
        {
            "introduced": "10.1.0"
        },
        {
            "fixed": "10.1.4"
        },
        {
            "introduced": "8.8.15-NA"
        },
        {
            "last_affected": "8.8.15-NA"
        },
        {
            "introduced": "8.8.15-p1"
        },
        {
            "last_affected": "8.8.15-p1"
        },
        {
            "introduced": "8.8.15-p10"
        },
        {
            "last_affected": "8.8.15-p10"
        },
        {
            "introduced": "8.8.15-p11"
        },
        {
            "last_affected": "8.8.15-p11"
        },
        {
            "introduced": "8.8.15-p12"
        },
        {
            "last_affected": "8.8.15-p12"
        },
        {
            "introduced": "8.8.15-p13"
        },
        {
            "last_affected": "8.8.15-p13"
        },
        {
            "introduced": "8.8.15-p14"
        },
        {
            "last_affected": "8.8.15-p14"
        },
        {
            "introduced": "8.8.15-p15"
        },
        {
            "last_affected": "8.8.15-p15"
        },
        {
            "introduced": "8.8.15-p16"
        },
        {
            "last_affected": "8.8.15-p16"
        },
        {
            "introduced": "8.8.15-p17"
        },
        {
            "last_affected": "8.8.15-p17"
        },
        {
            "introduced": "8.8.15-p18"
        },
        {
            "last_affected": "8.8.15-p18"
        },
        {
            "introduced": "8.8.15-p2"
        },
        {
            "last_affected": "8.8.15-p2"
        },
        {
            "introduced": "8.8.15-p20"
        },
        {
            "last_affected": "8.8.15-p20"
        },
        {
            "introduced": "8.8.15-p23"
        },
        {
            "last_affected": "8.8.15-p23"
        },
        {
            "introduced": "8.8.15-p24"
        },
        {
            "last_affected": "8.8.15-p24"
        },
        {
            "introduced": "8.8.15-p25"
        },
        {
            "last_affected": "8.8.15-p25"
        },
        {
            "introduced": "8.8.15-p26"
        },
        {
            "last_affected": "8.8.15-p26"
        },
        {
            "introduced": "8.8.15-p27"
        },
        {
            "last_affected": "8.8.15-p27"
        },
        {
            "introduced": "8.8.15-p29"
        },
        {
            "last_affected": "8.8.15-p29"
        },
        {
            "introduced": "8.8.15-p3"
        },
        {
            "last_affected": "8.8.15-p3"
        },
        {
            "introduced": "8.8.15-p30"
        },
        {
            "last_affected": "8.8.15-p30"
        },
        {
            "introduced": "8.8.15-p31"
        },
        {
            "last_affected": "8.8.15-p31"
        },
        {
            "introduced": "8.8.15-p31\\.1"
        },
        {
            "last_affected": "8.8.15-p31\\.1"
        },
        {
            "introduced": "8.8.15-p32"
        },
        {
            "last_affected": "8.8.15-p32"
        },
        {
            "introduced": "8.8.15-p33"
        },
        {
            "last_affected": "8.8.15-p33"
        },
        {
            "introduced": "8.8.15-p34"
        },
        {
            "last_affected": "8.8.15-p34"
        },
        {
            "introduced": "8.8.15-p35"
        },
        {
            "last_affected": "8.8.15-p35"
        },
        {
            "introduced": "8.8.15-p36"
        },
        {
            "last_affected": "8.8.15-p36"
        },
        {
            "introduced": "8.8.15-p37"
        },
        {
            "last_affected": "8.8.15-p37"
        },
        {
            "introduced": "8.8.15-p39"
        },
        {
            "last_affected": "8.8.15-p39"
        },
        {
            "introduced": "8.8.15-p4"
        },
        {
            "last_affected": "8.8.15-p4"
        },
        {
            "introduced": "8.8.15-p40"
        },
        {
            "last_affected": "8.8.15-p40"
        },
        {
            "introduced": "8.8.15-p41"
        },
        {
            "last_affected": "8.8.15-p41"
        },
        {
            "introduced": "8.8.15-p45"
        },
        {
            "last_affected": "8.8.15-p45"
        },
        {
            "introduced": "8.8.15-p46"
        },
        {
            "last_affected": "8.8.15-p46"
        },
        {
            "introduced": "8.8.15-p5"
        },
        {
            "last_affected": "8.8.15-p5"
        },
        {
            "introduced": "8.8.15-p6"
        },
        {
            "last_affected": "8.8.15-p6"
        },
        {
            "introduced": "8.8.15-p7"
        },
        {
            "last_affected": "8.8.15-p7"
        },
        {
            "introduced": "8.8.15-p8"
        },
        {
            "last_affected": "8.8.15-p8"
        },
        {
            "introduced": "8.8.15-p9"
        },
        {
            "last_affected": "8.8.15-p9"
        },
        {
            "introduced": "9.0.0-NA"
        },
        {
            "last_affected": "9.0.0-NA"
        },
        {
            "introduced": "9.0.0-p1"
        },
        {
            "last_affected": "9.0.0-p1"
        },
        {
            "introduced": "9.0.0-p10"
        },
        {
            "last_affected": "9.0.0-p10"
        },
        {
            "introduced": "9.0.0-p11"
        },
        {
            "last_affected": "9.0.0-p11"
        },
        {
            "introduced": "9.0.0-p13"
        },
        {
            "last_affected": "9.0.0-p13"
        },
        {
            "introduced": "9.0.0-p14"
        },
        {
            "last_affected": "9.0.0-p14"
        },
        {
            "introduced": "9.0.0-p16"
        },
        {
            "last_affected": "9.0.0-p16"
        },
        {
            "introduced": "9.0.0-p17"
        },
        {
            "last_affected": "9.0.0-p17"
        },
        {
            "introduced": "9.0.0-p18"
        },
        {
            "last_affected": "9.0.0-p18"
        },
        {
            "introduced": "9.0.0-p19"
        },
        {
            "last_affected": "9.0.0-p19"
        },
        {
            "introduced": "9.0.0-p2"
        },
        {
            "last_affected": "9.0.0-p2"
        },
        {
            "introduced": "9.0.0-p20"
        },
        {
            "last_affected": "9.0.0-p20"
        },
        {
            "introduced": "9.0.0-p22"
        },
        {
            "last_affected": "9.0.0-p22"
        },
        {
            "introduced": "9.0.0-p23"
        },
        {
            "last_affected": "9.0.0-p23"
        },
        {
            "introduced": "9.0.0-p24"
        },
        {
            "last_affected": "9.0.0-p24"
        },
        {
            "introduced": "9.0.0-p24\\.1"
        },
        {
            "last_affected": "9.0.0-p24\\.1"
        },
        {
            "introduced": "9.0.0-p25"
        },
        {
            "last_affected": "9.0.0-p25"
        },
        {
            "introduced": "9.0.0-p26"
        },
        {
            "last_affected": "9.0.0-p26"
        },
        {
            "introduced": "9.0.0-p27"
        },
        {
            "last_affected": "9.0.0-p27"
        },
        {
            "introduced": "9.0.0-p28"
        },
        {
            "last_affected": "9.0.0-p28"
        },
        {
            "introduced": "9.0.0-p29"
        },
        {
            "last_affected": "9.0.0-p29"
        },
        {
            "introduced": "9.0.0-p3"
        },
        {
            "last_affected": "9.0.0-p3"
        },
        {
            "introduced": "9.0.0-p30"
        },
        {
            "last_affected": "9.0.0-p30"
        },
        {
            "introduced": "9.0.0-p32"
        },
        {
            "last_affected": "9.0.0-p32"
        },
        {
            "introduced": "9.0.0-p33"
        },
        {
            "last_affected": "9.0.0-p33"
        },
        {
            "introduced": "9.0.0-p34"
        },
        {
            "last_affected": "9.0.0-p34"
        },
        {
            "introduced": "9.0.0-p38"
        },
        {
            "last_affected": "9.0.0-p38"
        },
        {
            "introduced": "9.0.0-p39"
        },
        {
            "last_affected": "9.0.0-p39"
        },
        {
            "introduced": "9.0.0-p4"
        },
        {
            "last_affected": "9.0.0-p4"
        },
        {
            "introduced": "9.0.0-p40"
        },
        {
            "last_affected": "9.0.0-p40"
        },
        {
            "introduced": "9.0.0-p41"
        },
        {
            "last_affected": "9.0.0-p41"
        },
        {
            "introduced": "9.0.0-p5"
        },
        {
            "last_affected": "9.0.0-p5"
        },
        {
            "introduced": "9.0.0-p6"
        },
        {
            "last_affected": "9.0.0-p6"
        },
        {
            "introduced": "9.0.0-p7"
        },
        {
            "last_affected": "9.0.0-p7"
        },
        {
            "introduced": "9.0.0-p8"
        },
        {
            "last_affected": "9.0.0-p8"
        },
        {
            "introduced": "9.0.0-p9"
        },
        {
            "last_affected": "9.0.0-p9"
        }
    ]
}

Affected versions

10.*
10.0.0-GA
10.0.1
10.0.11
10.0.2
10.0.5
10.0.6
10.0.7
10.0.8
10.0.9
10.1.0
10.1.1
10.1.2
10.1.3
8.*
8.8.15-NA
8.8.15-p1
8.8.15-p10
8.8.15-p11
8.8.15-p12
8.8.15-p13
8.8.15-p14
8.8.15-p15
8.8.15-p16
8.8.15-p17
8.8.15-p18
8.8.15-p2
8.8.15-p20
8.8.15-p23
8.8.15-p24
8.8.15-p25
8.8.15-p26
8.8.15-p27
8.8.15-p29
8.8.15-p3
8.8.15-p30
8.8.15-p31
8.8.15-p31\.1
8.8.15-p32
8.8.15-p33
8.8.15-p34
8.8.15-p35
8.8.15-p36
8.8.15-p37
8.8.15-p39
8.8.15-p4
8.8.15-p40
8.8.15-p41
8.8.15-p45
8.8.15-p46
8.8.15-p5
8.8.15-p6
8.8.15-p7
8.8.15-p8
8.8.15-p9
9.*
9.0.0-NA
9.0.0-p1
9.0.0-p10
9.0.0-p11
9.0.0-p13
9.0.0-p16
9.0.0-p17
9.0.0-p18
9.0.0-p19
9.0.0-p2
9.0.0-p20
9.0.0-p22
9.0.0-p23
9.0.0-p24
9.0.0-p24\.1
9.0.0-p25
9.0.0-p26
9.0.0-p27
9.0.0-p28
9.0.0-p29
9.0.0-p3
9.0.0-p30
9.0.0-p32
9.0.0-p33
9.0.0-p34
9.0.0-p38
9.0.0-p39
9.0.0-p4
9.0.0-p40
9.0.0-p41
9.0.0-p5
9.0.0-p6
9.0.0-p7
9.0.0-p8
9.0.0-p9

Database specific

vanir_signatures_modified 
"2026-07-22T04:02:04Z"
vanir_signatures 
[
    {
        "signature_type": "Function",
        "target": {
            "file": "store/src/java/com/zimbra/cs/service/account/ChangePassword.java",
            "function": "handle"
        },
        "deprecated": false,
        "source": "https://github.com/zimbra/zm-mailbox/commit/36b0176b086d3ced0cd751ec0aca4d9869574496",
        "id": "CVE-2025-48700-2802cfab",
        "signature_version": "v1",
        "digest": {
            "function_hash": "250239021129922179859369307689305685860",
            "length": 2910.0
        }
    },
    {
        "signature_type": "Function",
        "target": {
            "file": "store/src/java/com/zimbra/cs/service/account/ChangePassword.java",
            "function": "handle"
        },
        "deprecated": false,
        "source": "https://github.com/zimbra/zm-mailbox/commit/02deeb6294c2327768a7177124ea3bab2a56e56c",
        "id": "CVE-2025-48700-80107f44",
        "signature_version": "v1",
        "digest": {
            "function_hash": "250239021129922179859369307689305685860",
            "length": 2910.0
        }
    },
    {
        "signature_type": "Line",
        "target": {
            "file": "store/src/java/com/zimbra/cs/service/account/ChangePassword.java"
        },
        "deprecated": false,
        "source": "https://github.com/zimbra/zm-mailbox/commit/36b0176b086d3ced0cd751ec0aca4d9869574496",
        "id": "CVE-2025-48700-8d17d1e8",
        "signature_version": "v1",
        "digest": {
            "line_hashes": [
                "100352541356968744543459554936932541435",
                "34980778564753151690669805825885263298",
                "163615395104885010895005793672519100036",
                "324766885195200298088869019113793247780"
            ],
            "threshold": 0.9
        }
    },
    {
        "signature_type": "Line",
        "target": {
            "file": "store/src/java/com/zimbra/cs/service/account/ChangePassword.java"
        },
        "deprecated": false,
        "source": "https://github.com/zimbra/zm-mailbox/commit/02deeb6294c2327768a7177124ea3bab2a56e56c",
        "id": "CVE-2025-48700-f5d96fd7",
        "signature_version": "v1",
        "digest": {
            "line_hashes": [
                "100352541356968744543459554936932541435",
                "34980778564753151690669805825885263298",
                "163615395104885010895005793672519100036",
                "324766885195200298088869019113793247780"
            ],
            "threshold": 0.9
        }
    }
]
source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-48700.json"
github.com/zimbra/zm-zcs

Affected ranges

Type
GIT
Repo
https://github.com/zimbra/zm-zcs
Events
Introduced
6c72db05e6f1b89c511ba5c08ec4b6399bec7bb6
Last affected
7de0c769b7fc9297a78320491ecaa362b046a3d1
Database specific 
{
    "cpe": [
        "cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:-:*:*:*:*:*:*",
        "cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:p32:*:*:*:*:*:*",
        "cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:p33:*:*:*:*:*:*",
        "cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:p6:*:*:*:*:*:*",
        "cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:-:*:*:*:*:*:*",
        "cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p25:*:*:*:*:*:*",
        "cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p26:*:*:*:*:*:*"
    ],
    "source": "CPE_STRING",
    "extracted_events": [
        {
            "introduced": "8.8.15-NA"
        },
        {
            "last_affected": "8.8.15-NA"
        },
        {
            "introduced": "8.8.15-p32"
        },
        {
            "last_affected": "8.8.15-p32"
        },
        {
            "introduced": "8.8.15-p33"
        },
        {
            "last_affected": "8.8.15-p33"
        },
        {
            "introduced": "8.8.15-p6"
        },
        {
            "last_affected": "8.8.15-p6"
        },
        {
            "introduced": "9.0.0-NA"
        },
        {
            "last_affected": "9.0.0-NA"
        },
        {
            "introduced": "9.0.0-p25"
        },
        {
            "last_affected": "9.0.0-p25"
        },
        {
            "introduced": "9.0.0-p26"
        },
        {
            "last_affected": "9.0.0-p26"
        }
    ]
}

Affected versions

8.*
8.8.15
8.8.15-NA
8.8.15-p32
8.8.15-p33
8.8.15-p6
9.*
9.0.0
9.0.0-NA
9.0.0-p25
9.0.0-p26
9.0.0.p25
9.0.0.p26

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-48700.json"
github.com/zimbra/zm-zcs-lib

Affected ranges

Type
GIT
Repo
https://github.com/zimbra/zm-zcs-lib
Events
Introduced
e94be3228495cb215d7bb70d6ae24bc8a42cc01f
Fixed
c1556310402cd7363f11c8b974c23ed59389b884
Introduced
0da199c818c28750b27aec8c2aa1fa8420086d4e
Fixed
544f6ac469b9b633b2d42a8d66b8db8b24043708
Introduced
41db44a222b547dcc89ab50273cb8684195c09c2
Last affected
f7d07af90e612dba63830d5f7babb18d7c512eb4
Database specific 
{
    "cpe": [
        "cpe:2.3:a:synacor:zimbra_collaboration_suite:*:*:*:*:*:*:*:*",
        "cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:-:*:*:*:*:*:*",
        "cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:p20:*:*:*:*:*:*",
        "cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:p21:*:*:*:*:*:*",
        "cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:p23:*:*:*:*:*:*",
        "cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:p24:*:*:*:*:*:*",
        "cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:p3:*:*:*:*:*:*",
        "cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:p30:*:*:*:*:*:*",
        "cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:p31:*:*:*:*:*:*",
        "cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:p32:*:*:*:*:*:*",
        "cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:p34:*:*:*:*:*:*",
        "cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:p40:*:*:*:*:*:*",
        "cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:p5:*:*:*:*:*:*",
        "cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:-:*:*:*:*:*:*",
        "cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p13:*:*:*:*:*:*",
        "cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p14:*:*:*:*:*:*",
        "cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p16:*:*:*:*:*:*",
        "cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p17:*:*:*:*:*:*",
        "cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p23:*:*:*:*:*:*",
        "cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p24:*:*:*:*:*:*",
        "cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p25:*:*:*:*:*:*",
        "cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p27:*:*:*:*:*:*",
        "cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p3:*:*:*:*:*:*",
        "cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p33:*:*:*:*:*:*",
        "cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p4:*:*:*:*:*:*"
    ],
    "source": [
        "CPE_RANGE",
        "CPE_STRING"
    ],
    "extracted_events": [
        {
            "introduced": "10.0.0"
        },
        {
            "fixed": "10.0.12"
        },
        {
            "introduced": "10.1.0"
        },
        {
            "fixed": "10.1.4"
        },
        {
            "introduced": "8.8.15-NA"
        },
        {
            "last_affected": "8.8.15-NA"
        },
        {
            "introduced": "8.8.15-p20"
        },
        {
            "last_affected": "8.8.15-p20"
        },
        {
            "introduced": "8.8.15-p21"
        },
        {
            "last_affected": "8.8.15-p21"
        },
        {
            "introduced": "8.8.15-p23"
        },
        {
            "last_affected": "8.8.15-p23"
        },
        {
            "introduced": "8.8.15-p24"
        },
        {
            "last_affected": "8.8.15-p24"
        },
        {
            "introduced": "8.8.15-p3"
        },
        {
            "last_affected": "8.8.15-p3"
        },
        {
            "introduced": "8.8.15-p30"
        },
        {
            "last_affected": "8.8.15-p30"
        },
        {
            "introduced": "8.8.15-p31"
        },
        {
            "last_affected": "8.8.15-p31"
        },
        {
            "introduced": "8.8.15-p32"
        },
        {
            "last_affected": "8.8.15-p32"
        },
        {
            "introduced": "8.8.15-p34"
        },
        {
            "last_affected": "8.8.15-p34"
        },
        {
            "introduced": "8.8.15-p40"
        },
        {
            "last_affected": "8.8.15-p40"
        },
        {
            "introduced": "8.8.15-p5"
        },
        {
            "last_affected": "8.8.15-p5"
        },
        {
            "introduced": "9.0.0-NA"
        },
        {
            "last_affected": "9.0.0-NA"
        },
        {
            "introduced": "9.0.0-p13"
        },
        {
            "last_affected": "9.0.0-p13"
        },
        {
            "introduced": "9.0.0-p14"
        },
        {
            "last_affected": "9.0.0-p14"
        },
        {
            "introduced": "9.0.0-p16"
        },
        {
            "last_affected": "9.0.0-p16"
        },
        {
            "introduced": "9.0.0-p17"
        },
        {
            "last_affected": "9.0.0-p17"
        },
        {
            "introduced": "9.0.0-p23"
        },
        {
            "last_affected": "9.0.0-p23"
        },
        {
            "introduced": "9.0.0-p24"
        },
        {
            "last_affected": "9.0.0-p24"
        },
        {
            "introduced": "9.0.0-p25"
        },
        {
            "last_affected": "9.0.0-p25"
        },
        {
            "introduced": "9.0.0-p27"
        },
        {
            "last_affected": "9.0.0-p27"
        },
        {
            "introduced": "9.0.0-p3"
        },
        {
            "last_affected": "9.0.0-p3"
        },
        {
            "introduced": "9.0.0-p33"
        },
        {
            "last_affected": "9.0.0-p33"
        },
        {
            "introduced": "9.0.0-p4"
        },
        {
            "last_affected": "9.0.0-p4"
        }
    ]
}

Affected versions

10.*
10.0.0-GA
10.0.1
10.0.9
10.1.0
10.1.1
8.*
8.8.15-NA
8.8.15-p20
8.8.15-p21
8.8.15-p23
8.8.15-p24
8.8.15-p3
8.8.15-p30
8.8.15-p31
8.8.15-p32
8.8.15-p34
8.8.15-p40
8.8.15-p5
9.*
9.0.0-NA
9.0.0-p13
9.0.0-p14
9.0.0-p16
9.0.0-p17
9.0.0-p23
9.0.0-p24
9.0.0-p25
9.0.0-p27
9.0.0-p3
9.0.0-p4

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-48700.json"