Hostname Canonicalization VULN in Zimbra CSE 10.x DefangFilter
CVE-2026-93630 Published on October 23, 2026
Zimbra Collaboration Suite Email HTML Sanitizer Bypass via Hostname Canonicalization
A hostname canonicalization vulnerability in the email HTML sanitizers of Zimbra Collaboration Suite (ZCS) allows an unauthenticated sender to bypass the restriction on forms that target the Zimbra host. DefangFilter and the OWASP ActionAttributePolicy compare the form-action hostname with the request hostname before browser URL canonicalization. A percent-encoded hostname can therefore survive sanitization while the browser submits the form to the normal Zimbra origin with the recipient's authentication cookie. This permits authenticated form requests from a crafted email after the recipient opens it in Classic and submits the form. The issue is present in ZCS 10.1.16 and 10.1.21. It does not bypass an endpoint's CSRF-token checks; a state-changing attack additionally requires an endpoint that accepts the resulting request without that protection.
Vulnerability Analysis
CVE-2026-93630 is exploitable with network access, requires user interaction. This vulnerability is considered to have a low attack complexity. The potential impact of an exploit of this vulnerability is considered to have no impact on confidentiality, with no impact on integrity, and no impact on availability.
Weakness Type
Incorrect Behavior Order: Validate Before Canonicalize
The software validates input before it is canonicalized, which prevents the software from detecting data that becomes invalid after the canonicalization step. This can be used by an attacker to bypass the validation and launch attacks that expose weaknesses that would otherwise be prevented, such as injection.
Products Associated with CVE-2026-93630
Want to know whenever a new CVE is published for Zimbra Collaboration Suite? stack.watch will email you.
Affected Versions
Zimbra Collaboration Suite:- Before 10.1.21 is affected.