---
id: CVE-2025-66376
title: >-
  Zimbra Collaboration (ZCS) 10 before 10.0.18 and 10.1 before 10.1.13 allows
  Classic UI stored XSS via Cascading Style Sheets (CSS) @import directives in
  an HTML e-mail message.
summary: >-
  Zimbra Collaboration (ZCS) 10 before 10.0.18 and 10.1 before 10.1.13 allows
  Classic UI stored XSS via Cascading Style Sheets (CSS) @import directives in
  an HTML e-mail message.
severity: high
cvss: 7.2
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N'
cwe:
  - CWE-79
vendor: synacor
product: zimbra_collaboration_suite
affected:
  - 'zimbra_collaboration_suite >= 10.0.0, < 10.0.18'
  - 'zimbra_collaboration_suite >= 10.1.0, < 10.1.13'
patched:
  - zimbra_collaboration_suite 10.1.13
published: '2026-01-05'
updated: '2026-09-30'
sourceUpdated: '2026-09-30T23:10:00.237'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2025-66376'
references:
  - url: 'https://wiki.zimbra.com/wiki/Security_Center'
    label: cve@mitre.org
  - url: 'https://wiki.zimbra.com/wiki/Zimbra_Releases/10.0.18#Security_Fixes'
    label: cve@mitre.org
  - url: 'https://wiki.zimbra.com/wiki/Zimbra_Releases/10.1.13#Security_Fixes'
    label: cve@mitre.org
  - url: 'https://wiki.zimbra.com/wiki/Zimbra_Responsible_Disclosure_Policy'
    label: cve@mitre.org
  - url: 'https://wiki.zimbra.com/wiki/Zimbra_Security_Advisories'
    label: cve@mitre.org
  - url: >-
      https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-66376
    label: 134c704f-9b21-4f2e-91b3-4a467353bcc0
tags:
  - nvd
  - kev
  - in-the-wild
epss: 0.19559
epssPercentile: 0.97303
kev: true
kevDateAdded: '2026-03-18'
kevDueDate: '2026-04-01'
kevRansomware: false
exploited: true
ingestedAt: '2026-09-30T23:29:32.540Z'
---

## Overview

Zimbra Collaboration (ZCS) 10 before 10.0.18 and 10.1 before 10.1.13 allows Classic UI stored XSS via Cascading Style Sheets (CSS) @import directives in an HTML e-mail message.

## Affected

- `zimbra_collaboration_suite >= 10.0.0, < 10.0.18`
- `zimbra_collaboration_suite >= 10.1.0, < 10.1.13`

## Remediation

Upgrade past the affected range:

- `zimbra_collaboration_suite 10.1.13`