CVE-2026-93633: CWE-79 Improper neutralization of input during web page generation ('cross-site scripting') in Zimbra Zimbra Collaboration Suite

This vulnerability involves a CSS sanitization flaw in Zimbra Collaboration Suite where the DefangFilter fails to sanitize the final ASCII segment of stylesheets containing non-ASCII characters. As a result, HTML stored as application/x-zimbra-doc can retain CSS URL references that bypass normal sanitization. An authenticated user with Briefcase access can exploit this by publishing a crafted document that loads external resources and displays a credential-collection form using Zimbra's own visual assets. Successful exploitation requires the victim to open the document inline in a browser and submit the form, enabling credential theft. Affected versions include ZCS up to 10.1.20.

An attacker with authenticated Briefcase access can publish malicious documents that execute attacker-controlled scripts within the context of the Zimbra origin. This can lead to credential theft if victims interact with the malicious content. The vulnerability does not allow remote unauthenticated exploitation and requires user interaction to open the malicious document and submit a form. The CVSS score of 5.4 reflects limited impact with user interaction and privileges required.

No official patch or fix information is provided in the available data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict Briefcase access to trusted users only and educate users to avoid opening suspicious documents inline. Monitor for vendor updates regarding patches or official mitigations.