Zimbra Collaboration is vulnerable to stored cross-site scripting caused by an unsanitized Content-Location header in email attachments. An attacker can craft a MIME message that includes a javascript: URI in the header; when a victim opens the attachment name in the web interface, the malicious script runs in the victim's browser context, enabling theft of session data or other credential hijacking. The weakness relates to improper input validation (CWE-79).

Synacor Zimbra Collaboration software is affected. All releases prior to version 10.1.21 lack the defensive change that sanitizes the Content-Location header. Users running older Zimbra Collaboration are therefore exposed until a fix is applied.

The CVSS score of 5.3 indicates moderate severity, and the vulnerability is not listed in CISA KEV; EPSS data is unavailable. The likely attack path is via an unauthenticated remote attacker emailing a crafted message to a legitimate recipient, who then needs to open the attachment and click the file name to trigger the payload. Given the remote nature and the need for victim interaction, exploitation is possible in realistic phishing scenarios, but the spread is limited to individuals with access to the impacted email system.