CVE-2025-68645βSynacor Zimbra Collaboration Suite (ZCS) PHP Remote File Inclusion Vulnerability
PUBLISHEDvulnerability record
2026-01-22 Β· last modified January 23, 2026
Metadata
Vulnerability Name
Synacor Zimbra Collaboration Suite (ZCS) PHP Remote File Inclusion Vulnerability
Description
Synacor Zimbra Collaboration Suite (ZCS) contains a PHP remote file inclusion vulnerability that could allow for remote attackers to craft requests to the /h/rest endpoint to influence internal request dispatching, allowing inclusion of arbitrary files from the WebRoot directory.
Known To Be Used in Ransomware Campaigns?
Action
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.