A stored cross‑site scripting flaw exists in the Zimbra Briefcase feature. The application fails to sanitize particular uploaded file types, letting an attacker embed malicious JavaScript. When a user opens a publicly shared Briefcase file containing that script, the code executes within the user’s browser context, giving the attacker the ability to run arbitrary scripts under the victim’s authority.

Synacor Zimbra Collaboration Suite versions 10.0 and 10.1 are affected. Any installation that uses the Briefcase feature and shares its contents publicly is vulnerable.

The vulnerability has a CVSS score of 6.1 and an EPSS lower than 1 %. It can be exploited by uploading a crafted file to a publicly accessible Briefcase folder. No special permissions on the server are required; the attacker only needs a user account with upload rights. Once the victim opens the file, the attacker’s script runs, potentially exfiltrating data or performing other actions. The flaw is not listed in the KEV catalog, but its straightforward exploit path makes it an attractive target for attackers seeking to compromise user accounts without host‑level privileges.