CVE-2026-73574: 
Zimbra Collaboration Server vulnerability analysis and mitigation

CVE-2026-73574 is a Local File Inclusion (LFI) vulnerability in the Zimbra Classic Web Client's Forward servlet, caused by improper validation of the fu request parameter. It affects Zimbra Collaboration versions before 10.1.17 and was published on August 13, 2026. The vulnerability carries a CVSS v3.1 base score of 3.1 (Low severity), reflecting its high attack complexity and limited confidentiality impact (GitHub Advisory, Zimbra Security Advisories).

The root cause is improper input validation of the fu request parameter in the Forward servlet of the Zimbra Classic Web Client, classified as CWE-669 (Incorrect Resource Transfer Between Spheres), with path traversal (CWE-22) also applicable. An attacker can supply a crafted path value to the fu parameter to cause the servlet to include and return the contents of protected files within the web application directory, such as WEB-INF/web.xml. Exploitation requires network access and low-level authentication, with high attack complexity, meaning specific conditions must be met for a successful attack (GitHub Advisory).

Successful exploitation allows a low-privileged, network-based attacker to read sensitive protected files within the Zimbra web application directory, such as WEB-INF/web.xml, which may contain configuration details, credentials, or other sensitive application data. The impact is limited to confidentiality — there is no integrity or availability impact — and the scope is unchanged, meaning exploitation is confined to the vulnerable component. Exposure of configuration files could, however, facilitate further attacks by revealing internal application structure or credentials (GitHub Advisory).

As of the disclosure date, there is no public proof-of-concept exploit and no evidence of active in-the-wild exploitation (GitHub Advisory). The EPSS score is approximately 0.201%, placing it in the 10th percentile for exploitation likelihood within the next 30 days. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The NVD SSVC assessment notes the vulnerability is automatable but with no known exploitation at this time.

1. Reconnaissance: Identify Zimbra Collaboration instances running versions prior to 10.1.17 that expose the Classic Web Client interface over the network, using tools such as Shodan or Censys.
2. Authentication: Obtain low-privileged credentials for the Zimbra instance (e.g., a standard user account), as the vulnerability requires at minimum low-level privileges.
3. Craft malicious request: Send an HTTP request to the Forward servlet endpoint, manipulating the fu request parameter with a crafted path (e.g., path traversal sequences) targeting sensitive files such as WEB-INF/web.xml.
4. Retrieve sensitive file contents: If the server fails to properly validate the fu parameter, it will include and return the contents of the targeted protected file in the HTTP response, disclosing configuration data or other sensitive information (GitHub Advisory).

• Network: Unusual HTTP requests to the Zimbra Forward servlet endpoint containing path traversal sequences (e.g., ../, %2e%2e%2f) in the fu parameter; requests targeting WEB-INF/web.xml or other protected configuration files.
• Logs: Zimbra web server access logs showing repeated or anomalous GET/POST requests to the Forward servlet with crafted fu parameter values; HTTP 200 responses to requests for files that should not be publicly accessible.
• File System: No direct file system artifacts expected, as this is a read-only disclosure vulnerability; however, monitor for unexpected access patterns to WEB-INF/ directory files in application logs.

The primary remediation is to upgrade Zimbra Collaboration to version 10.1.17 or later, which addresses the improper validation of the fu request parameter (Zimbra Security Advisories, GitHub Advisory). As interim mitigations, administrators should implement input validation and sanitization for the fu parameter, apply network segmentation and access controls to restrict access to the Zimbra Classic Web Client, and monitor and log file access attempts to the Forward servlet for suspicious activity. Restricting access to the Zimbra web interface to trusted networks or VPN users can further reduce exposure.

The vulnerability was noted by Zimbra's official security advisory page and tracked by multiple vulnerability intelligence platforms including VulDB, CVEFeed, and INCIBE-CERT shortly after disclosure (Zimbra Security Advisories). No significant independent researcher commentary or broad media coverage has been identified at this time, consistent with the vulnerability's low severity rating and absence of active exploitation.