An authenticated user in Zimbra Collaboration Suite can send arbitrary e‑mail by injecting carriage‑return/line‑feed characters into the email address field of a JSON SOAP request. The vul neable data‑source testing component concatenates the supplied address into an SMTP envelope command; when the target SMTP server accepts pipelined transactions, attackers can submit mail with any recipients, headers and body and bypass victim interaction. The result is a form of command injection that enables spoofed e‑mail sending rather than code execution.

The vulnerability exists in Zimbra Collaboration Suite versions 10.1.16 and 10.1.20. Recipients with normal account privileges and account options enabled can trigger the flaw.

The CVSS score of 4.3 indicates moderate severity. EPSS data are not available and the flaw is not listed in the CISA KEV catalog. The likely attack vector requires an authenticated user to invoke the data‑source test feature. Once injected, the attacker can send arbitrary e‑mail without user interaction, posing a risk of spam, phishing or domain spoofing. The exploit conditions are limited to users having account options enabled, so the overall exploitability is moderate.