CVE-2022-27925

This bug is like giving a staff member a “file return” box (the ZIP import) and letting them unpack it into any location on the building—not just where it’s supposed to go. Because it’s an administrator-only feature, the danger is that if an attacker gets an administrator account, they can place files on your server to install malware or take over the system.

This matters if your business runs Zimbra Collaboration Suite and your system is on Zimbra Collaboration Suite 8.8.15 or 9.0. The risky path requires an authenticated administrator user using the mboximport ZIP handling, so it becomes a real concern when admin accounts are reachable or could be stolen. Because CISA KEV says it’s been used in ransomware campaigns, assume attackers will target internet-facing setups where they can obtain administrator access.

This is RED because it’s confirmed in CISA’s KEV and has been used in ransomware campaigns. Attackers have a known way to turn the ZIP import into arbitrary file placement, which can enable malware and full compromise after obtaining admin access.

Confirm exposure

1. Identify your exact Zimbra Collaboration Suite version(s). If you are on 8.8.15 or 9.0, assume you may be affected.
2. Confirm whether the mboximport ZIP handling (ZIP archive upload/extraction) is available and reachable in your environment.
3. Inventory admin accounts and how they authenticate (especially anything that could be exposed to the internet or vulnerable to credential theft).

Upgrade to the fixed version

1. Follow Zimbra’s vendor remediation guidance in their Security Center and the Zimbra 9.0.0 P24 / patch materials.
2. Upgrade all affected Zimbra nodes (including load-balanced instances) to the vendor-fixed release(s referenced in those pages.
3. Validate after upgrade that mboximport ZIP extraction behavior is updated and that admin users cannot write outside the intended import boundaries.

Temporary workaround (if patching is delayed)

1. Reduce risk by restricting or disabling mboximport ZIP import where possible until the upgrade is complete.
2. Tighten administrator access: remove unused admin accounts, enforce strong authentication for admins, and block any untrusted IPs or networks from reaching admin entry points.
3. Monitor for suspicious ZIP import activity from admin accounts (unusual times, unusual file names/paths, repeated failures).

CISA due date

• CISA KEV remediation due date was 2022-09-01; treat this as already overdue for affected deployments.

What to monitor

• Evidence of arbitrary file writes consistent with directory traversal attempts.
• Signs of post-exploitation activity (new unexpected files, unexpected processes/services, changes to email server components) around the time of any mboximport usage.

Severity and weakness

• Weakness category: CWE-22 (Path Traversal).
• Reported impact characteristics include upload-and-extract leading to directory traversal / arbitrary file placement.

Mechanism (how it’s triggered)

• The Zimbra mboximport feature receives a ZIP archive and extracts files during processing.
• An authenticated administrator can upload a ZIP crafted to cause extraction into arbitrary locations on the server.

Exploitation status

• Confirmed exploited: the vulnerability is listed in CISA KEV as having been used in ransomware campaigns.
• Public exploit availability is reported (at least one known), and exploitation has been reported.

KEV meaning

• CISA KEV indicates real-world demonstrated exploitation in targeted activity, which is why this is treated as immediately actionable rather than speculative.

Prediction notes

• A very high EPSS prediction is noted in the findings; however, KEV and exploitation reporting are the primary drivers for urgency.