CVE-2022-41352

Deeper analysis

CVE-2022-41352 is a path traversal vulnerability in Zimbra Collaboration Suite (ZCS) versions 8.8.15 and 9.0 that stems from insufficient validation in the amavis component when handling archive extraction via cpio. An attacker can upload arbitrary files that are written to the publicly accessible directory /opt/zimbra/jetty/webapps/zimbra/public, enabling unauthorized access to other user accounts. The flaw is tracked under CWE-22 and carries a CVSS 3.1 score of 9.8.

An unauthenticated remote attacker can exploit the issue by sending a crafted archive through amavis; successful exploitation grants full read/write access to mailbox data and configuration files belonging to any account on the server. Because the vector requires no credentials or user interaction, the attack can be launched directly over the network.

Zimbra security advisories and the vendor wiki recommend replacing cpio with pax for archive handling; pax is listed among Ubuntu prerequisites and is automatically preferred by amavis once installed. On Red Hat and CentOS systems after version 6, administrators must explicitly install pax because it is no longer present in default installations.

Public references, including Packet Storm and SecPod reporting, document active in-the-wild exploitation of the unpatched flaw, and the associated EPSS score has remained above 0.93 with a recorded peak of 0.97, indicating sustained attacker interest after disclosure.