CVE-2020-12846

Zimbra before 8.8.15 Patch 10 and 9.x before 9.0.0 Patch 3 allows remote code execution via an avatar file. There is potential abuse of /service/upload servlet in the webmail subsystem. A user can upload executable files (exe,sh,bat,jar) in the Contact section of the mailbox as an avatar image for a contact. A user will receive a "Corrupt File" error, but the file is still uploaded and stored locally in /opt/zimbra/data/tmp/upload/, leaving it open to possible remote execution.

• CWE-434

• https://wiki.zimbra.com/wiki/Security_CenterRelease Notes, Vendor Advisory
• https://wiki.zimbra.com/wiki/Zimbra_Releases/9.0.0/P3Vendor Advisory
• https://wiki.zimbra.com/wiki/Zimbra_Security_AdvisoriesVendor Advisory
• https://wiki.zimbra.com/wiki/Security_CenterRelease Notes, Vendor Advisory
• https://wiki.zimbra.com/wiki/Zimbra_Releases/9.0.0/P3Vendor Advisory
• https://wiki.zimbra.com/wiki/Zimbra_Security_AdvisoriesVendor Advisory

Published

Jun 3, 2020

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2020-1284A denial of service vulnerability exists in the way that the…6.5
• CVE-2020-12840ismartgate PRO 1.5.9 is vulnerable to CSRF that allows remot…6.5
• CVE-2020-12841ismartgate PRO 1.5.9 is vulnerable to CSRF that allows remot…6.5
• CVE-2020-12842ismartgate PRO 1.5.9 is vulnerable to privilege escalation b…9.8
• CVE-2020-12843ismartgate PRO 1.5.9 is vulnerable to malicious file uploads…9.8
• CVE-2020-12845Cherokee 0.4.27 to 1.2.104 is affected by a denial of servic…7.5
• CVE-2020-12847Pydio Cells 2.0.4 web application offers an administrative c…7.2
• CVE-2020-12848In Pydio Cells 2.0.4, once an authenticated user shares a fi…5.4
• CVE-2020-12849Pydio Cells 2.0.4 allows any user to upload a profile image …5.4
• CVE-2020-1285<p>A remote code execution vulnerability exists in the way t…8.4
• CVE-2020-12850The following vulnerability applies only to the Pydio Cells …7
• CVE-2020-12851Pydio Cells 2.0.4 allows an authenticated user to write or o…8.1