Zimbra Classic UI is vulnerable to a stored Cross-Site Scripting (XSS) flaw via the From email header during HTML reply composition. An attacker can send a crafted email with a malicious From header containing JavaScript. When the victim opens the message and replies in HTML mode with reply headers disabled, the payload executes in the browser. This can lead to session theft or unauthorized actions. The issue is fixed in version 10.1.21.