CVE-2026-93643 Overview
CVE-2026-93643 is a critical path traversal vulnerability [CWE-22] in Zimbra Collaboration when OnlyOffice/Document Editing is enabled. An unauthenticated remote attacker with access to an existing public Briefcase document can abuse unsigned save fields to write files outside the intended directory. The traversal primitive allows the attacker to execute arbitrary commands as the zimbra user. The flaw requires no privileges and no user interaction over the network.
Critical Impact
Unauthenticated remote code execution as the zimbra service account, resulting in full compromise of mail server contents, stored credentials, and downstream collaboration data.
Affected Products
- Zimbra Collaboration deployments with OnlyOffice/Document Editing enabled
- Zimbra Briefcase feature exposing public documents
- Refer to the Zimbra Security Advisories for exact affected builds
Discovery Timeline
- 2026-09-25 - CVE-2026-93643 published to NVD
- 2026-09-29 - Last updated in NVD database
Technical Details for CVE-2026-93643
Vulnerability Analysis
The vulnerability resides in the integration between Zimbra Briefcase and the OnlyOffice/Document Editing component. When a user edits a supported document, OnlyOffice issues a callback to Zimbra containing metadata describing where to persist the updated file. Several fields in this save payload are not cryptographically signed or validated against the originating document path. An attacker who can reach a public Briefcase document can craft a save callback that includes traversal sequences in the destination path.
Because the destination is honored without canonicalization, the write primitive escapes the Briefcase storage directory. The attacker can place files under directories executed by the zimbra runtime, achieving command execution as zimbra. The entire exploitation flow bypasses authentication because the target document is publicly accessible.
Root Cause
The root cause is insufficient validation of save-callback fields combined with the absence of a signed integrity envelope on the OnlyOffice-to-Zimbra callback. The server trusts attacker-controlled path components and writes to arbitrary filesystem locations relative to the Briefcase storage root.
Attack Vector
Exploitation requires only network reachability to the Zimbra web interface and knowledge of a supported public Briefcase document. The attacker triggers a document edit session, then issues or intercepts the save callback with a path containing ../ traversal segments pointing to a filesystem location the zimbra user can execute from. No credentials or user interaction are required.
No verified public proof-of-concept code is referenced in the advisory data. Refer to the Zimbra Security Advisories for technical details.
Detection Methods for CVE-2026-93643
Indicators of Compromise
- Unexpected files written outside the Briefcase storage directory owned by the zimbra user
- OnlyOffice save callbacks containing ../ sequences or absolute paths in destination fields
- New or modified files under Zimbra webapp directories, cron paths, or shell startup files for the zimbra account
- Outbound network connections initiated by zimbra processes to unfamiliar hosts following document edit activity
Detection Strategies
- Inspect Zimbra and OnlyOffice access logs for document save requests with abnormal path parameters
- Correlate Briefcase public document access with subsequent shell or interpreter execution by the zimbra user
- Alert on file writes by the OnlyOffice callback handler that resolve outside the designated Briefcase data path
Monitoring Recommendations
- Enable filesystem auditing on Zimbra webapp, cron, and configuration directories
- Monitor child-process creation under the zimbra user, especially shells and scripting interpreters spawned from Java workers
- Centralize Zimbra and OnlyOffice logs in a SIEM and retain for retrospective investigation of this callback endpoint
How to Mitigate CVE-2026-93643
Immediate Actions Required
- Apply the Zimbra security patch referenced in the Zimbra Security Advisories as soon as available
- Disable OnlyOffice/Document Editing integration until the patch is deployed
- Audit all public Briefcase documents and remove unnecessary public shares
- Review the Zimbra server for signs of post-exploitation activity under the zimbra account
Patch Information
Zimbra publishes fixes through its security advisory channel. Administrators should consult the Zimbra Security Advisories wiki for the specific patch level that addresses CVE-2026-93643 and apply updates for all affected Zimbra Collaboration releases.
Workarounds
- Disable the OnlyOffice/Document Editing feature in Zimbra configuration until patched
- Restrict Briefcase public sharing and remove existing public documents of supported editable types
- Place the Zimbra web interface behind an authenticated reverse proxy or VPN to reduce exposure of the vulnerable callback endpoint
- Enforce strict filesystem permissions on directories executed or sourced by the zimbra user to limit write-to-execute paths
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.