CVE-2022-27925: Zimbra Collaboration Path Traversal Flaw

CVE-2022-27925 Overview

CVE-2022-27925 is a directory traversal vulnerability affecting Zimbra Collaboration Suite (ZCS) versions 8.8.15 and 9.0. The vulnerability exists within the mboximport functionality, which processes ZIP archives and extracts files from them. An authenticated user with administrator rights can exploit this flaw to upload arbitrary files to the system by crafting a malicious ZIP archive containing path traversal sequences, potentially leading to remote code execution.

Critical Impact

This vulnerability is listed in CISA's Known Exploited Vulnerabilities (KEV) catalog and has been actively exploited in the wild. With an EPSS score of 94.31% (99.943 percentile), there is an extremely high probability of exploitation. Organizations running vulnerable Zimbra instances should prioritize immediate patching.

Affected Products

• Zimbra Collaboration Suite 8.8.15 (all patch levels through p30)
• Zimbra Collaboration Suite 9.0.0 (all patch levels through p23)
• Synacor Zimbra Collaboration Suite (all vulnerable versions)

Discovery Timeline

• April 21, 2022 - CVE-2022-27925 published to NVD
• October 31, 2025 - Last updated in NVD database

Technical Details for CVE-2022-27925

Vulnerability Analysis

This directory traversal vulnerability occurs in Zimbra's mboximport functionality, which is designed to import mailbox data from ZIP archives. The vulnerable endpoint fails to properly sanitize file paths contained within uploaded ZIP archives before extraction. When an authenticated administrator uploads a specially crafted ZIP file, the extraction process follows directory traversal sequences (such as ../) embedded in the archived file names, allowing files to be written outside the intended directory structure.

The impact of successful exploitation is significant. An attacker can write arbitrary files to any location on the filesystem accessible to the Zimbra service account. This capability can be leveraged to achieve remote code execution by writing webshells to web-accessible directories or overwriting configuration files. The vulnerability requires administrator-level authentication, though when chained with other vulnerabilities (such as CVE-2022-37042 for authentication bypass), unauthenticated remote code execution becomes possible.

Root Cause

The root cause of CVE-2022-27925 is improper input validation in the ZIP archive extraction routine within the mboximport functionality. The code fails to implement adequate path canonicalization and validation checks before extracting files from the uploaded archive. Specifically, the extraction process does not strip or reject path components like ../ that could navigate outside the intended destination directory, resulting in a classic "Zip Slip" vulnerability pattern (CWE-22: Improper Limitation of a Pathname to a Restricted Directory).

Attack Vector

The attack is conducted over the network against the Zimbra web interface. An attacker with valid administrator credentials can exploit the vulnerability by:

1. Crafting a malicious ZIP archive containing files with directory traversal sequences in their filenames (e.g., ../../../../opt/zimbra/jetty/webapps/zimbra/webshell.jsp)
2. Authenticating to the Zimbra administration interface
3. Uploading the malicious ZIP file through the mboximport endpoint
4. Upon extraction, the embedded files are written to arbitrary locations based on the traversal paths

The vulnerability mechanism involves crafting a ZIP archive where file entries contain path traversal sequences such as ../../../ in their names. When the Zimbra mboximport functionality extracts these files, it fails to validate the destination path, allowing the attacker to write files to arbitrary locations on the filesystem. For example, an attacker could include an entry named ../../../../opt/zimbra/jetty/webapps/zimbra/malicious.jsp to plant a webshell in the web-accessible directory. For detailed technical analysis and proof-of-concept information, see the Packet Storm Exploit Analysis.

Detection Methods for CVE-2022-27925

Indicators of Compromise

• Unexpected files appearing in web-accessible directories such as /opt/zimbra/jetty/webapps/zimbra/
• JSP or other executable files created outside normal deployment directories
• Unusual HTTP POST requests to /service/extension/backup/mboximport endpoints with ZIP payloads
• Log entries showing mboximport operations from unexpected sources or at unusual times

Detection Strategies

• Monitor web server access logs for requests to the mboximport endpoint, particularly from external IP addresses
• Implement file integrity monitoring on critical Zimbra directories to detect unauthorized file creation
• Review authentication logs for administrator account usage, especially from unfamiliar IP addresses or at unusual times
• Deploy network-based detection rules to identify ZIP files with suspicious path traversal patterns in HTTP traffic

Monitoring Recommendations

• Enable verbose logging for Zimbra administrative operations and export logs to a SIEM for analysis
• Configure alerts for any file creation events in the Zimbra webapps directory that don't correspond to legitimate updates
• Monitor for outbound connections from the Zimbra server to unexpected destinations, which may indicate successful compromise
• Regularly audit administrator accounts and remove unnecessary privileged access

How to Mitigate CVE-2022-27925

Immediate Actions Required

• Upgrade Zimbra Collaboration Suite 8.8.15 to patch level p31 or later immediately
• Upgrade Zimbra Collaboration Suite 9.0.0 to patch level p24 or later immediately
• Audit all administrator accounts and enforce strong authentication policies including multi-factor authentication
• Review Zimbra servers for signs of compromise, including unexpected files in web directories and suspicious log entries

Patch Information

Zimbra has released security patches addressing this vulnerability. Organizations should apply the following updates:

• Zimbra 8.8.15: Upgrade to patch level p31 or later
• Zimbra 9.0.0: Upgrade to patch level p24 or later

Detailed release information is available in the Zimbra Release Notes 9.0.0 P24 and the Zimbra Security Advisories Archive. Organizations should also review the Zimbra Security Center Overview for comprehensive security guidance.

Workarounds

• Restrict access to the Zimbra administration interface to trusted IP addresses only using firewall rules or network segmentation
• If immediate patching is not possible, consider temporarily disabling the mboximport functionality if it is not required for operations
• Implement a web application firewall (WAF) with rules to detect and block ZIP uploads containing path traversal patterns
• Place Zimbra servers behind a reverse proxy that can filter malicious requests targeting known vulnerable endpoints

# Example: Restrict access to Zimbra admin interface via iptables
# Allow admin access only from trusted management network
iptables -A INPUT -p tcp --dport 7071 -s 10.0.1.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 7071 -j DROP

# Example: Block external access to mboximport endpoint via nginx
# Add to nginx server configuration
location /service/extension/backup/mboximport {
    allow 127.0.0.1;
    allow 10.0.1.0/24;
    deny all;
}