Zimbra email software has a stored cross-site scripting (XSS) vulnerability via the Content-Location MIME header in email attachments. An attacker can craft an email with a malicious Content-Location header containing a javascript: URI. When a victim opens the email in the Zimbra web interface and clicks the attachment name, the JavaScript payload executes in the victim's browser. This vulnerability was fixed in Zimbra version 10.1.21.