Zimbra Classic Web Client XSS flaw lets attackers run code via crafted emails
Zimbra Collaboration Suite's Classic Web Client suffers a stored XSS flaw (CVE-2025-27915) that executes JavaScript when a user opens a crafted email with an embedded calendar file. Exploitation grants attackers full session control, enabling actions like email redirection and data exfiltration. Zimbra released version 10.1.19 to patch the issue.