High severity7.5NVD Advisory· Published Dec 19, 2024· Updated Jun 17, 2026
CVE-2024-54663
CVE-2024-54663
Description
An issue was discovered in the Webmail Classic UI in Zimbra Collaboration (ZCS) 9.0 and 10.0 and 10.1. A Local File Inclusion (LFI) vulnerability exists in the /h/rest endpoint, allowing authenticated remote attackers to include and access sensitive files in the WebRoot directory. Exploitation requires a valid auth token and involves crafting a malicious request targeting specific file paths.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
3- Zimbra Collaboration/Zimbra Collaborationdescription
- cpe:2.3:a:synacor:zimbra_collaboration_suite:*:*:*:*:*:*:*:*Range: >=9.0.0,<10.0.11
Patches
Vulnerability mechanics
References
2- wiki.zimbra.com/wiki/Zimbra_Releases/10.0.11nvdRelease Notes
- wiki.zimbra.com/wiki/Zimbra_Releases/10.1.3nvdRelease Notes
News mentions
0No linked articles in our index yet.