Staff

FortiGuard Outbreak Alert: Zimbra Collaboration Local File Inclusion

Forum|Forum|6 months ago
February 11, 2026
0 replies
117 views

Description

Zimbra Collaboration Suite (ZCS) is an open-core email and collaboration platform combining a modern web client with calendar, contacts, task management, and file sharing, available as both on-premises and cloud solutions.

CVE-2025-68645 is a local file inclusion (LFI) in Webmail Classic UI of Zimbra Collaboration (ZCS) which allows an unauthenticated remote attacker to send a crafted request to retrieve arbitrary files from the server's filesystem, potentially exposing sensitive information such as configuration files, authentication tokens, or other internal application data.

The following versions of Zimbra Collaboration Suite (ZCS) are vulnerable to CVE-2025-68645:

10.0.0 ≤ Version < 10.0.18
10.1.0 ≤ Version < 10.1.13

CVE ID

CVE-2025-68645.

NDR Cloud Detection Rule

FortiNDR Cloud v26.1+

Detection Rule Name	Category	Primary MITRE ID
FortiGuard Outbreak Alert: Zimbra Collaboration Local File Inclusion - CVE-2025-68645	Attack: Exploitation	T1190 - Exploit Public-Facing Application

Playbook

N/A.

Threat Hunting

FortiNDR Cloud users can use the following IOCs from Fortinet to hunt for 'Zimbra Collaboration Local File Inclusion' related activities.
IOC source: Zimbra Collaboration Local File Inclusion | Indicators of Compromise.

All IOCs relating to 'Zimbra Collaboration Local File Inclusion' have been added to Threat Intelligence Intel.

Suricata Coverage

N/A.

Other Fortinet Products

For more details regarding mitigating the vulnerability by utilizing Fortinet products, refer to Zimbra Collaboration Local File Inclusion.