Zimbra Collaboration - RCE (CVE-2022-27925)
Description
Zimbra Collaboration (aka ZCS) 8.8.15 and 9.0 has mboximport functionality that receives a ZIP archive and extracts files from it. An authenticated user with administrator rights has the ability to upload arbitrary files to the system, leading to directory traversal.
psychologyCrowdSec Analysis
CVE-2022-27925 is a vulnerability in Zimbra Collaboration that can allow authenticated administrators to upload arbitrary files via the backup import feature, resulting in directory traversal and potential system compromise.
CrowdSec has been tracking this vulnerability and its exploits since 1st of April 2025.
CrowdSec network data shows that most actors exploiting CVE-2022-27925 rely on broad, untargeted scans with minimal filtering. The activity is largely automated and opportunistic in nature. Additionally, according to week-over-week analysis by CrowdSec, exploitation of CVE-2022-27925 is surging. Attack volumes are spiking well above historical norms, indicating widespread and escalating interest from threat actors. CVE-2022-27925 is currently experiencing high visibility and active exploitation across the internet.
Indicators of exploitation include requests to URLs containing /service/extension/backup/mboximport.
Full Intelligence Available
Connect your API key to access CrowdSec scores, exploit timelines, and attacker IPs.
| Event | Date |
|---|---|
| CVE Published | 2022-04-20 |
| CISA KEV | 2022-08-11 |
| CISA Remediation Deadline | 2022-09-01 |
| Rule Released | 2025-04-01 |
| CrowdSec First Seen | 2025-04-01 |