This vulnerability in Zimbra Collaboration prior to 10.1.17 involves incorrect resource transfer between spheres (CWE-669) due to improper validation of the 'fu' request parameter in the Forward servlet. It allows an unauthenticated attacker to perform local file inclusion (LFI) by crafting a path that can disclose protected files within the web application directory. The CVSS 3.1 base score is 3.1, reflecting low impact with network attack vector, high attack complexity, low privileges required, no user interaction, and limited confidentiality impact.

An attacker can gain unauthorized read access to protected files within the Zimbra web application directory, potentially exposing sensitive configuration or internal files. The impact is limited to confidentiality with no effect on integrity or availability. The vulnerability requires high attack complexity and low privileges but no user interaction.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or remediation level is provided, users should monitor the vendor's security advisories for updates. Until a patch is available, restricting access to the vulnerable servlet or implementing web application firewall rules to block malicious 'fu' parameter inputs may help mitigate risk.