A CSS sanitization flaw in Zimbra Collaboration Suite allows an authenticated Briefcase user to publish a document that contains attacker‑controlled CSS. When the stylesheet includes non‑ASCII characters, the DefangFilter mistakenly appends the final ASCII segment without sanitization, so CSS URL references survive the normal sanitizer. The resulting document can load remote resources and display an inline credential‑collection form using Zimbra’s own visual assets. This is effectively an XSS‑style vulnerability that can steal user credentials when the victim opens the document.

Zimbra Collaboration Suite versions 10.1.16 and 10.1.20 are affected. Users running these releases should review their Briefcase sharing configurations and consider the vulnerability until a patch is applied.

The vulnerability has a CVSS score of 5.4, indicating moderate severity. EPSS data is not available, and it is not listed in the CISA KEV catalog. Exploitation requires the attacker to distribute a crafted document that the victim opens in a browser rendering the content type inline. If the victim submits the displayed credential form, the attacker can capture the credentials. The risk is moderate and primarily limited to users who open shared Briefcase documents.