Zimbra Collaboration (aka ZCS) 8.8.15 and 9.0 has mboximport functionality that receives a ZIP archive and extracts files from it. An authenticated user with administrator rights has the ability to upload arbitrary files to the system, leading to directory traversal.
CPE | Name | Operator | Version |
---|---|---|---|
collaboration | eq | 9.0.0 | |
collaboration | eq | 8.8.15 |