Critical Zimbra SSRF Flaw Exposes Sensitive Data

GBHackers reports a critical Zimbra SSRF flaw in the chat proxy configuration that could allow attackers to access sensitive data. Zimbra released an emergency patch, delivering version 10.1.12 on 16 October 2025 to address the vulnerability, which affects 10.1.5 through 10.1.11. The flaw’s high severity stems from Server-Side Request Forgery, enabling unauthorised requests to internal or external resources and potentially exposing confidential information, network details, and authentication tokens.

The article notes several risk areas, including data exposure, network reconnaissance, credential theft, and access to internal resources, while adding that Zimbra classifies deployment risk as low. Administrators are urged to apply the patch immediately to protect enterprise email infrastructure, with emphasis on those using affected versions.