The flaw is a local file inclusion vulnerability in the Zimbra Classic Web Client’s Forward servlet caused by insufficient validation of the request parameter "fu". An attacker can provide a crafted value that causes the servlet to include arbitrary files from the web application directory, exposing sensitive configuration files such as WEB‑INF/web.xml. The weakness maps to CWE‑669 and results in unauthorized disclosure of protected files.

Zimbra Collaboration installations running any version before 10.1.17 are affected, specifically those using the Classic Web Client. Systems that have not applied the 10.1.17 update remain vulnerable.

With a CVSS score of 3.1 the flaw is considered moderate; an unauthenticated attacker can trigger the inclusion by sending a crafted HTTP request, making the vulnerability a valid attack vector for unauthenticated users within or on the same network. No publicly available exploit code has been reported and the issue is not listed in the CISA KEV catalog, indicating a lower exploitation probability at present, yet the potential disclosure of configuration files presents a non‑trivial risk.