CVE-2025-68645: Synacor Zimbra Collaboration Suite (ZCS) PHP Remote File Inclusion Vulnerability

Synacor Zimbra Collaboration Suite contains a PHP remote file inclusion vulnerability. Attackers can craft requests that cause the application to include arbitrary files from its WebRoot directory, potentially leading to unauthorized access within the collaboration environment. This matters for organizations that rely on ZCS for email and shared services, as the flaw affects request handling at a core endpoint.

How it works

The weakness is categorized as CWE-98. It allows remote attackers to influence internal request dispatching by sending crafted requests to the /h/rest endpoint.

• This behavior permits inclusion of arbitrary files present inside the WebRoot directory.
• Exploitation does not require authentication in the described scenario.

Am I affected? How to find it in your systems

Zimbra Collaboration Suite typically runs as an on-premises or hosted email and groupware server. Inventory deployments by locating ZCS installations and their web application components.

• Check running instances for the affected software and review configuration files that control request routing.
• Confirm whether the specific versions or settings in use match the conditions described in the vendor advisory.
• Examine web server and application logs for anomalous requests targeting the /h/rest endpoint.

How to remediate

Apply the vendor update referenced in the official advisory. After patching, review PHP file-handling settings and restrict unnecessary inclusion of files from the WebRoot directory.

• Validate all inputs that affect request dispatching to prevent external influence on file paths.
• Disable or tightly control any features that allow dynamic file inclusion if they are not required.

If you can't patch immediately

Apply mitigations per the vendor instructions. Segment networks so that only authorized systems can reach the ZCS web endpoints.

• Deploy web application firewall rules that block or log unexpected requests to /h/rest.
• Disable the affected endpoint or feature if the vendor provides that option.
• For cloud-hosted instances, follow applicable BOD 22-01 guidance; discontinue use of the product if no mitigations are available.

If your data may have been exposed

Actively exploited vulnerabilities in this class can result in breaches. Run a free exposure scan of organizational email addresses against known breach data to identify potential prior exposure.