Critical Zimbra Flaw Fixed: Patch Addresses Multiple Stored XSS and Unauthenticated LFI in Mail Client

Daily CyberSecurity reports that a critical Zimbra flaw has been fixed, with the patch addressing multiple stored XSS and an unauthenticated LFI in the Zimbra mail client. The piece is dated 11 November 2025. The report notes that the vulnerability involved stored cross‑site scripting and an unauthenticated local file inclusion issue within the mail client, and that the issued patch remedies these flaws.

The article’s audience is indicated as supporters, but the key takeaway for readers is that the Zimbra mail client now has mitigations for these two classes of vulnerability. No additional technical specifics are provided in the article excerpt.