Zimbra Under Siege: High-Severity LFI Vulnerability Exposes Internal Files to Unauthenticated Attackers

Administrators of Zimbra Collaboration Suite are being urged to patch after two vulnerabilities were disclosed, tracked as CVE-2025-68645 and CVE-2025-67809, affecting the 10.0 and 10.1 branches. The most severe, CVE-2025-68645, is a high-severity Local File Inclusion in the Webmail Classic UI’s RestFilter servlet that allows an unauthenticated attacker to read internal files by crafting requests to the /h/rest endpoint, potentially exposing sensitive server data.

The second flaw, CVE-2025-67809 (CVSS 4.7), involves a hardcoded Flickr API key and secret embedded in the Flickr Zimlet, which could enable an attacker to impersonate the Zimbra application and initiate OAuth flows to access a user’s private Flickr data, according to the NIST notes.

Vendors have since revoked the compromised key and removed the secrets, and updates have been released to squash both bugs; administrators should upgrade to Zimbra Collaboration 10.1.13 or 10.0.18 immediately to mitigate potential reconnaissance or data leakage by opportunistic threat actors.