The vulnerability is a stored cross‑site scripting flaw in Zimbra Collaboration. It arises because the From email header is not properly sanitized when a user composes a reply in HTML mode using the Classic UI, and the reply headers feature is disabled. An attacker can embed JavaScript inside the From header of a crafted email. When an unsuspecting user opens the email and replies in the vulnerable UI, the script runs in the victim’s browser, allowing the attacker to steal session tokens or perform actions under the victim’s credentials.

Zimbra Collaboration from Synacor is affected in all releases prior to 10.1.21. The flaw was addressed in version 10.1.21 and subsequent releases.

The CVSS score is 5.3, indicating a moderate severity. EPSS data is unavailable and the vulnerability is not listed in the CISA KEV catalog. Attackers do not need privileged access; they can send a malicious email to a target user and rely on the vulnerable mail client to execute the payload when the user replies. The primary vector is an untrusted email sent to an end‑user, and the exploit requires the victim to open the message in Classic UI with HTML reply composition active while reply headers are disabled.