CVE-2026-115785: CWE-93 Improper neutralization of CRLF sequences ('CRLF injection') in Zimbra Zimbra Collaboration Suite

This vulnerability involves improper neutralization of CRLF sequences (CWE-93) in the data-source testing functionality of Zimbra Collaboration Suite. An authenticated user can inject CR/LF characters into the emailAddress parameter of an SMTP envelope command through a JSON SOAP request. After a successful POP3 or IMAP login, Zimbra forwards these injected commands to the SMTP service. If the SMTP service accepts the pipelined transaction, the attacker can send emails with arbitrary recipients, headers, and content. The vulnerable code path exists in ZCS versions 10.1.16 through 10.1.20.

The vulnerability allows an authenticated user to send emails with attacker-chosen recipients, headers, and body content without requiring interaction from the victim. This could be used to bypass normal email sending restrictions and potentially facilitate phishing or spam campaigns. There is no direct confidentiality or availability impact reported. The CVSS score of 4.3 reflects a medium severity with low complexity and no user interaction required.

No official patch or fix is currently documented. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict account options to trusted users and monitor for suspicious email sending behavior. Avoid enabling data-source testing functionality for untrusted accounts.