CVE-2026-73574: 
Zimbra Collaboration Server vulnerability analysis and mitigation

CVE-2026-73574 is a Local File Inclusion (LFI) vulnerability in the Zimbra Classic Web Client's Forward servlet, caused by improper validation of the fu request parameter. It affects Zimbra Collaboration versions before 10.1.17 and was published on August 13, 2026. The vulnerability carries a CVSS v3.1 base score of 3.1 (Low), reflecting high attack complexity and limited confidentiality impact (GitHub Advisory, Zimbra Security Advisories).

The root cause is improper input validation of the fu request parameter in the Forward servlet of the Zimbra Classic Web Client, classified as CWE-669 (Incorrect Resource Transfer Between Spheres), with an estimated path traversal component (CWE-22). An attacker can supply a crafted path value to the fu parameter to cause the servlet to include and return the contents of protected files within the web application directory, such as WEB-INF/web.xml. Exploitation requires network access and low-level privileges, but is rated high complexity, limiting ease of exploitation (GitHub Advisory).

Successful exploitation allows a low-privileged, network-based attacker to read sensitive protected configuration files within the Zimbra web application directory, such as WEB-INF/web.xml, which may contain database credentials, internal configuration details, or other sensitive application settings. There is no integrity or availability impact; the vulnerability is limited to confidentiality disclosure. Exposure of configuration files could facilitate further attacks by revealing internal application structure or credentials (GitHub Advisory).

As of the time of publication, there is no known public proof-of-concept exploit and no evidence of active in-the-wild exploitation (GitHub Advisory). The EPSS score is approximately 0.201%, indicating a low probability of exploitation within the next 30 days. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. No threat actor attribution has been reported.

1. Reconnaissance: Identify internet-facing Zimbra Collaboration instances running versions prior to 10.1.17 using tools such as Shodan or Censys, targeting the Zimbra Classic Web Client login page.
2. Authenticate with low-privilege credentials: Obtain or use any low-privileged Zimbra account, as the vulnerability requires at least low-level privileges.
3. Craft malicious request: Send an HTTP request to the Forward servlet endpoint, manipulating the fu request parameter with a crafted path (e.g., path traversal sequences) targeting sensitive files such as WEB-INF/web.xml.
4. Retrieve sensitive file contents: If the server fails to properly validate the fu parameter, the response will include the contents of the targeted protected file, potentially exposing configuration data, credentials, or application internals (GitHub Advisory).

• Network: Unusual HTTP requests to the Zimbra Forward servlet endpoint containing path traversal sequences (e.g., ../, %2e%2e%2f) in the fu parameter; requests targeting WEB-INF/web.xml or other protected paths.
• Logs: Zimbra web server access logs showing requests to the Forward servlet with anomalous fu parameter values; repeated access attempts from a single IP with varying path values.
• File System: No direct file system artifacts expected, as this is a read-only disclosure vulnerability; however, monitor for unexpected access to WEB-INF/web.xml in application logs.

Upgrade Zimbra Collaboration to version 10.1.17 or later, which addresses this vulnerability (Zimbra Security Advisories). As interim mitigations, implement strict input validation and sanitization for the fu request parameter, apply network segmentation and access controls to restrict access to the Zimbra Classic Web Client, and monitor and log file access attempts to the Forward servlet for suspicious activity. Restricting access to the Zimbra web interface to trusted IP ranges can further reduce exposure.