The Zimbra Collaboration Suite 10.0 and 10.1 contain a reflected cross‑site scripting vulnerability in the Classic Webmail REST interface (/h/rest). An unauthenticated attacker can embed malicious JavaScript in a crafted URL; when a victim opens that link, the script runs inside the webmail application context, allowing the attacker to act as the victim. This is a reflected XSS weakness identified as CWE‑79.

Affected systems are Zimbra Collaboration Suite versions 10.0 and 10.1 from Synacor. No other versions were listed as vulnerable in the advisory.

The CVSS score is 6.1, indicating moderate severity, and the EPSS score is below 1%, suggesting low current exploitation probability. The vulnerability is not listed in CISA's KEV catalog, implying no known widespread exploitation at the time of reporting. Exploitation requires an unauthenticated attacker to lure a user to a crafted URL; the impact includes session hijacking or unauthorized actions within the webmail context. Overall, the risk is moderate but actionable mitigation is recommended.