A local privilege escalation vulnerability exists in the optional dnscache package of Zimbra Collaboration Suite. The vulnerability is triggered by the passwordless sudo rule that allows the low‑privilege zimbra user to execute the zmunbound wrapper with any arguments. The wrapper forwards those arguments to Unbound without sanitizing the configuration file path, enabling an attacker to specify a configuration that removes the root‑only chroot restriction and grants root privileges. Attackers can use this to read arbitrary root‑owned files through include directives that expose file contents on parser errors, or create or append to a root‑owned logfile path. This can expose password hashes, private keys, and corrupt privileged configuration files, leading to loss of service availability.

Affected product is Zimbra Collaboration Suite. The vulnerability is present in the dnscache package for ZCS version 10.1.16 and 10.1.21. Any deployment using these versions is at risk.

The CVSS score of 7.8 indicates a high severity. The EPSS score is not available, so the current exploitation probability is unknown, but the vulnerability is local and requires the zimbra account or an attacker who can gain local shell access. Because the attack path involves privileged sudo usage, the risk to confidentiality, integrity and availability of the machine is high, especially for services that rely on Unbound. The vulnerability is not listed in the CISA KEV catalog, so the breadth of known public exploits is not yet documented, but the dynamics of local attacks suggest it could be exploited by skilled adversaries.