Zimbra CVE-2025-68645: Exploited /h/rest File Inclusion

What to do

1. Check every mailbox node with su - zimbra -c 'zmcontrol -v'.
2. Upgrade to the current Zimbra 10.1 patch; 10.1.13 is the minimum for this CVE.
3. Migrate any 10.0, 9.0 or 8.8.15 server to 10.1, since those lines get no further fixes.
4. As a stopgap only, block requests to /h/rest that carry javax.servlet.include parameters at your reverse proxy or WAF.
5. If the server was exposed unpatched after mid-January 2026, review it for follow-on compromise and rotate its secrets.

How to check if you are affected or compromised

• Grep Zimbra access logs for /h/rest requests containing javax.servlet.include (grep -E '/h/rest.*javax' /opt/zimbra/log/access_log.*).
• Treat 200 responses to those requests, especially for /WEB-INF/ paths, as successful file reads.
• Look for new or modified JSP files under /opt/zimbra/jetty_base/webapps/ and for unexpected admin logins after any hit.

What happened#

On November 6, 2025, Zimbra shipped 10.1.13 and 10.0.18 with a batch of security fixes. One is described as "an unauthenticated local file inclusion vulnerability in the RestFilter" (10.1.13 notes, 10.0.18 notes). Zimbra's advisory table credits devme4f of VNPT-VCI. As heise noted, Zimbra gave few details at release.

The CVE record, published December 22, explains the bug. The RestFilter servlet in the Classic web UI mishandles request parameters, so "an unauthenticated remote attacker" can send requests to /h/rest that steer internal request dispatching and pull in arbitrary files from the WebRoot directory. CISA's ADP scores it CVSS 3.1 8.8 (NVD). KEV calls it a "PHP remote file inclusion". Zimbra and the CVE record call it local file inclusion, and Zimbra's web tier runs on Java and Jetty, not PHP.

CISA added it to KEV on January 22, 2026, with a February 12 deadline, and gave no details of the attacks. CrowdSec released a detection rule on January 14 and first saw exploitation on January 19. The requests it documents pass javax.servlet.include.servlet_path to /h/rest to fetch files such as /WEB-INF/web.xml. CrowdSec told SecurityWeek the activity looked like "highly targeted attacks" in "sophisticated, intelligence-driven campaigns", and that attempts were surging. Beazley Security notes a public proof of concept on GitHub.

Who is affected#

Zimbra 10.1.0 through 10.1.12 and 10.0.0 through 10.0.17. The CVE names only those two lines. It does not say whether the older 9.0 and 8.8.15 code has the same flaw, and those lines stopped receiving fixes in 2025 and 2024 (release table). The 10.0.18 notes say Zimbra 10.0 reached end of life on December 31, 2025, so 10.0.18 is that line's last fix.

Do you really need to act?#

If you are on 10.1.13 or later and keep up with patches, this bug is already closed. Otherwise, yes. It needs no login, works over the same HTTPS port as webmail, and has a public exploit. Exploitation started less than a month after the CVE was published. On its own, the bug reads files from the web application. It is not documented as direct code execution. But SecurityWeek notes it can expose internal paths and configuration that help an attacker go further when chained with other weaknesses. A mail server is a valuable foothold, so close the bug and then check whether anyone used it.

What to do now#

1. Check each mailbox node: su - zimbra -c "zmcontrol -v".
2. Upgrade to the current 10.1 patch. Zimbra released 10.1.20 in July 2026; 10.1.13 is the minimum for this CVE.
3. Migrate 10.0, 9.0 and 8.8.15 servers to 10.1.
4. As a stopgap only, not vendor guidance: at your reverse proxy or WAF, block /h/rest requests that carry javax.servlet.include parameters.
5. If the server was exposed and unpatched after mid-January 2026, review it and rotate its secrets.

How to tell if you were hit#

Search the access logs for the documented pattern: grep -E '/h/rest.*javax' /opt/zimbra/log/access_log.*, and the proxy log /opt/zimbra/log/nginx.access.log if you use the Zimbra proxy. A 200 response, especially for /WEB-INF/ paths, means a file was served. After any hit, look for new or changed JSP files under /opt/zimbra/jetty_base/webapps/, unexpected admin logins, and new accounts. Rotate any credentials or keys stored in files the attacker could have read.

Timeline#

• Nov 6, 2025 — Zimbra releases 10.1.13 and 10.0.18 with the fix.
• Dec 22, 2025 — CVE-2025-68645 is published.
• Dec 31, 2025 — Zimbra 10.0 reaches end of life.
• Jan 14, 2026 — CrowdSec releases a detection rule.
• Jan 19, 2026 — CrowdSec first sees exploitation.
• Jan 22, 2026 — CISA adds the CVE to KEV.
• Feb 12, 2026 — CISA's remediation deadline for federal agencies.

Vulnerability records

• CVE-2025-68645 · KEV 2026-01-22 · A Local File Inclusion (LFI) vulnerability exists in the Webmail Classic UI of Zimbra Collaboration (ZCS) 10.0 and 10.1 because of improper handling of…

Sources

Original sources first: vendor and project advisories, CVE and government records, the discoverers’ write-ups. Every claim above links to one of these. See how the Security Desk works.

Original and primary sources

1. Zimbra — Zimbra Daffodil 10.1.13 release notes (archived) web.archive.org
2. Zimbra — Zimbra Daffodil 10.0.18 release notes (archived) web.archive.org
3. Zimbra — Security Advisories (archived Jan 2026) web.archive.org
4. CVE record — CVE-2025-68645 cve.org
5. NVD — CVE-2025-68645 nvd.nist.gov
6. CISA — Known Exploited Vulnerabilities: CVE-2025-68645 cisa.gov
7. CrowdSec — Live Exploit Tracker: Zimbra LFI (CVE-2025-68645) tracker.crowdsec.net
8. Zimbra — Zimbra Releases and lifecycle (archived Jun 2026) web.archive.org
9. Zimbra — Patch Release Update: Zimbra 10.1.20 (Jul 20, 2026) blog.zimbra.com
10. Beazley Security — Critical vulnerability in Zimbra webmail under active exploitation beazley.security
11. heise — Groupware Zimbra: Updates patch several security vulnerabilities (Nov 7, 2025) heise.de

Coverage and analysis

1. SecurityWeek — Organizations warned of exploited Zimbra Collaboration vulnerability (Jan 23, 2026) securityweek.com