CVE-2026-93643

Executive Summary

CVE-2026-93643 is a critical, unpatched path-traversal vulnerability (CWE-22) affecting the OnlyOffice/Document Editing integration within a Zimbra deployment environment. When the OnlyOffice integration is enabled, an unauthenticated remote attacker who has access to an existing supported public Briefcase document can abuse unsigned save fields to perform path-traversal writes, ultimately achieving arbitrary command execution under the zimbra service account. With a CVSS base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), the flaw requires no privileges or user interaction, making it exceptionally dangerous for any internet-exposed Zimbra instance that exposes the affected integration.

Technical Analysis

The vulnerability resides in the interaction between Zimbra's Document Editing capability and the document save workflow. According to the NVD description, when OnlyOffice/Document Editing is available, the save function accepts "unsigned save fields." This implies that the integrity of the save request — specifically the fields that dictate where a document is written — is not cryptographically validated or authenticated. Because these fields are unsigned, an attacker can supply arbitrary values that are then used to construct a filesystem write path.

The core weakness is a path-traversal condition (CWE-22). By injecting directory-traversal sequences into the save path fields, an attacker can escape the intended document storage directory and write files to arbitrary locations on the underlying filesystem. The description explicitly states that this traversal leads to the ability to "execute commands as zimbra," which indicates that the write primitive can be leveraged to place an executable artifact (for example, in a location that is later invoked by the Zimbra service or a web-accessible directory) and trigger its execution with the privileges of the zimbra user.

Critically, the attack is unauthenticated (PR:N) and requires no user interaction (UI:N). The only precondition stated is that the attacker has "access to an existing supported public Briefcase document." A public Briefcase document is one that is shared publicly, which is a common configuration in collaborative Zimbra environments. Because the save endpoint is reachable without authentication, the attacker does not need valid credentials — only knowledge of or access to a public document identifier.

The exact names of the save fields, the implementation of the signing mechanism (or lack thereof), and the precise filesystem paths are not disclosed in the available description. No source code diff or patch is available, consistent with the unpatched status (Patch Confidence 0/4). Consequently, the analysis here is limited to the vulnerability class and its described behavior; no specific function, parameter, or file names can be asserted beyond what is quoted from the NVD description.

Exploitation Scenarios

The following attack chain is inferred strictly from the vulnerability class (CWE-22) and the NVD description. No public PoC or exploit code exists at the time of writing.

1. Reconnaissance / Target Identification: The attacker identifies an internet-facing Zimbra instance that has the OnlyOffice/Document Editing feature enabled. Fingerprinting may involve observing the presence of document-editing endpoints or the characteristic behavior of the Briefcase module. The attacker also needs to identify an existing supported public Briefcase document — a document that has been shared publicly and is therefore accessible without authentication.

2. Triggering the Flaw: The attacker crafts a request to the document save functionality associated with the Document Editing integration. Instead of (or in addition to) legitimate field values, the attacker injects path-traversal sequences into the unsigned save fields that control the output path. Because these fields are unsigned, the server does not reject the tampered values. The traversal sequences cause the write operation to resolve to a location outside the intended document storage directory.

3. Payload / Execution Method (vulnerability-class level): Using the path-traversal write primitive, the attacker writes a malicious file to a location on the server that will subsequently be executed or processed by the Zimbra service. Because the description states the outcome is "execute commands as zimbra," the mechanism is best described generically: the arbitrary write enables placement of an executable payload or a file consumed by a script interpreter running under the zimbra account. The attacker does not need to authenticate to the application; the flaw is reachable through the unauthenticated save path.

4. Post-Exploitation Impact: Successful exploitation results in arbitrary command execution with the privileges of the zimbra user. This gives the attacker full control over mail data, configuration, and the Zimbra application stack, enabling data theft, persistence, lateral movement within the mail environment, and potential further compromise of the host.

No public PoC is available; the attack chain above is inferred from the vulnerability class and the provided description. It does not rely on any function, parameter, or path names that are not explicitly present in the source data.

Impact Assessment

The CVSS v3.1 base score is 9.8, reflecting the maximum severity band. The subscores indicate:

• Confidentiality (C:H): Total loss of confidentiality. An attacker executing code as zimbra can read all mail content, user data, credentials, and configuration stored by the service.
• Integrity (I:H): Total loss of integrity. The attacker can modify mail, documents, and system files, and plant persistent backdoors.
• Availability (A:H): Total loss of availability. The attacker could disrupt or destroy the mail service and its data.
• Attack Vector (AV:N): Exploitable remotely over the network, not requiring local access.
• Attack Complexity (AC:L): No special conditions beyond the stated access to a public Briefcase document and the enabled integration; the attack is straightforward once the entry point is identified.
• Privileges Required (PR:N): No authentication needed.
• User Interaction (UI:N): No victim action required beyond the existence of the publicly shared document.

The blast radius covers the Zimbra server itself and potentially all users and data managed by that server. Because the zimbra account typically has extensive access to mail stores, configuration, and the web application, compromise of this account is effectively full compromise of the collaboration platform. Any organization running Zimbra with the OnlyOffice/Document Editing integration enabled and a publicly accessible Briefcase is at critical risk.

Detection Guidance

Sigma Rule

title: Path Traversal via Zimbra OnlyOffice Document Save Fields
id: 8f3c9a17-2e5d-4b1a-bf7c-6a2d1e0f5c9b
status: experimental
description: Detects attempts to exploit CVE-2026-93643 by writing files outside the intended document directory through path-traversal sequences in save fields.
author: Threat Intelligence
date: 2026-01-01
logsource:
  product: zimbra
  service: document-editing
detection:
  selection_save:
    event_type: 'document_save'
  selection_traversal:
    save_path|contains:
      - '../'
      - '..\\'
      - '%2e%2e%2f'
      - '%2e%2e%5c'
  condition: selection_save and selection_traversal
falsepositives:
  - Legitimate documents with filenames containing '..' in unusual contexts (rare)
level: critical

YARA Rule

rule CVE_2026_93643_Zimbra_PathTraversal
{
    meta:
        description = "Detects path-traversal payloads targeting CVE-2026-93643 in Zimbra save requests"
        author = "Threat Intelligence"
        date = "2026-01-01"
        reference = "CVE-2026-93643"
        severity = "critical"

    strings:
        $traversal1 = "../" ascii wide nocase
        $traversal2 = "..\\" ascii wide nocase
        $traversal3 = "%2e%2e%2f" ascii wide nocase
        $traversal4 = "%2e%2e%5c" ascii wide nocase
        $savefield = "save" ascii wide nocase
        $briefcase = "Briefcase" ascii wide nocase

    condition:
        uint32(0) != 0x504b0304 and
        (any of ($traversal*)) and
        (any of ($savefield, $briefcase))
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-93643 Zimbra OnlyOffice Path Traversal Save Attempt"; flow:to_server,established; http.method; content:"POST"; http.uri; content:"save"; nocase; http.request_body; content:"../"; distance:0; within:200; reference:cve,2026-93643; classtype:web-application-attack; sid:2026936; rev:1;)

Elastic Detection

process where event.type == "start" and process.name == "zimbra" and
  process.args : ("*../*", "*..\\*")

Splunk SPL Query

index=zimbra sourcetype=zimbra_document_editing
| search save_path=*"../"* OR save_path=*"..\\"* OR save_path=*"%2e%2e%2f"* OR save_path=*"%2e%2e%5c"*
| stats count min(_time) as firstTime max(_time) as lastTime by src_ip, user, save_path, dest
| where count > 0

Wazuh OSSEC Rule

<group name="zimbra,">
  <rule id="100936" level="12">
    <decoded_as>json</decoded_as>
    <field name="event_type">document_save</field>
    <field name="save_path">\.\./|\.\.\\|%2e%2e%2f|%2e%2e%5c</field>
    <description>CVE-2026-93643: Path traversal attempt detected in Zimbra document save (possible exploit)</description>
    <mitre>
      <id>T1190</id>
    </mitre>
    <group>exploit_attempt,cve_2026_93643,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 — UNPATCHED. No vendor fix, workaround, or patch evidence is available from any tracked source.

1. Immediate Mitigations:

   • If OnlyOffice/Document Editing integration is not strictly required, disable it to remove the attack surface. This directly addresses the precondition stated in the NVD description ("When OnlyOffice/Document Editing is available").
   • Restrict access to public Briefcase documents. Audit all Briefcase shares and revoke public access where possible. An attacker needs access to an existing supported public Briefcase document; eliminating public exposure raises the bar significantly.
   • Place the Zimbra web interface behind an authenticated reverse proxy or VPN, reducing exposure of the unauthenticated save endpoint to trusted networks only.
   • Enforce strict filesystem permissions on the zimbra service account to limit where it can write, and monitor for unexpected file creation outside designated document directories.

2. Patch/Upgrade Steps:

   • No official patch is available as of this writing. Monitor Zimbra's security advisories and the NVD entry for CVE-2026-93643 for a vendor fix.
   • When a patch is released, apply it immediately to all Zimbra servers with the Document Editing integration enabled. Validate that the fix properly signs or validates save fields to prevent path traversal.

3. Long-Term Hardening:

   • Implement cryptographic signing or server-side validation of all save-related fields in the document editing workflow.
   • Apply the principle of least privilege to the zimbra service account, ensuring it cannot write to web-executable directories or arbitrary filesystem locations.
   • Deploy network segmentation and egress filtering to contain post-exploitation activity if command execution occurs.
   • Conduct regular security reviews of integrations (OnlyOffice/Document Editing) that introduce unauthenticated save or upload endpoints.

References

• NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-93643
• MITRE CVE: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-93643
• CWE-22 Path Traversal: https://cwe.mitre.org/data/definitions/22.html
• CISA KEV Catalog (Not listed at time of writing): https://www.cisa.gov/known-exploited-vulnerabilities-catalog
• Zimbra Security Advisories (monitor for patch): https://wiki.zimbra.com/wiki/Security_Center

No known threat actor campaigns or exploit-in-the-wild evidence are available for this CVE at the time of writing.