CVE-2026-33370

An issue was discovered in Zimbra Collaboration (ZCS) 10.0 and 10.1. A stored cross-site scripting (XSS) vulnerability exists in the Zimbra Briefcase feature due to insufficient sanitization of specific uploaded file types. When a user opens a publicly shared Briefcase file containing malicious scripts, the embedded JavaScript executes in the context of the user's session. This allows an attacker to run arbitrary scripts, potentially leading to data exfiltration or other unauthorized actions on behalf of the victim user.

• CWE-79

• https://wiki.zimbra.com/wiki/Security_CenterRelease Notes, Vendor Advisory
• https://wiki.zimbra.com/wiki/Zimbra_Releases/10.1.16#Security_FixesRelease Notes
• https://wiki.zimbra.com/wiki/Zimbra_Responsible_Disclosure_PolicyProduct
• https://wiki.zimbra.com/wiki/Zimbra_Security_AdvisoriesVendor Advisory

Published

Mar 20, 2026

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-33361In Meari IoT SDK image handling (libmrplayer.so) as observed…7.5
• CVE-2026-33362In Meari IoT SDK builds embedded in CloudEdge 5.5.0 (build 2…8.6
• CVE-2026-33366Missing authentication for critical function vulnerability i…6.9
• CVE-2026-33368Zimbra Collaboration Suite (ZCS) 10.0 and 10.1 contains a re…6.1
• CVE-2026-33369Zimbra Collaboration (ZCS) 10.0 and 10.1 contains an LDAP in…4.3
• CVE-2026-3337Observable timing discrepancy in AES-CCM decryption in AWS-L…8.2
• CVE-2026-33371An issue was discovered in Zimbra Collaboration (ZCS) 10.0 a…4.3
• CVE-2026-33372An issue was discovered in Zimbra Collaboration (ZCS) 10.0 a…5.4
• CVE-2026-33373An issue was discovered in Zimbra Collaboration (ZCS) 10.0 a…8.8
• CVE-2026-33375The Grafana MSSQL data source plugin contains a logic flaw t…6.5
• CVE-2026-33376When using an IPv6 allow-list for the Auth Proxy feature, it…7.4
• CVE-2026-33377An Editor can overwrite a dashboard not owned by them to acq…7.1