A reflected cross‑site scripting flaw (CWE‑79) exists in the Classic Web Client of Zimbra Collaboration Suite. The flaw resides in the document editor’s packages parameter, where the system inserts package names into script attributes without proper HTML encoding, allowing injected JavaScript. When combined with an earlier credential‑reuse vulnerability (CVE‑2026‑50053), an attacker can craft a URL containing a legitimate authentication token and document identifiers. If a victim opens that URL, the malicious script runs in the victim’s browser context, granting the attacker the ability to read mailbox contents and perform actions on behalf of the victim.

Zimbra Collaboration Suite version 10.1.16 is affected. The issue is fixed in version 10.1.17. No other versions or products are listed as impacted.

The CVSS score of 8.7 reflects a high‑severity vulnerability that is exploitable remotely with user interaction. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog. The attack vector likely involves a malicious link sent to a user; once the user visits the link, the script executes automatically, potentially compromising the victim’s session. Because the flaw is remote but requires the victim to click the URL, the actual exploitation probability may be moderate, yet the impact is severe if the attacker succeeds.