---
title: "Zimbra CVE-2025-68645: Exploited /h/rest File Inclusion"
url: https://erroneo.us/security/briefs/zimbra-cve-2025-68645-restfilter-file-inclusion/
description: "Unauthenticated file inclusion via /h/rest in Zimbra 10.0/10.1, fixed in 10.1.13 and 10.0.18 (Nov 2025) and exploited since Jan 2026. Patch to current 10.1."
type: security-brief
section: "Security Digest"
date_published: 2025-11-06
date_modified: 2026-10-23
publisher: erroneo.us
author: erroneo.us Security Desk
verdict: "Check exposure"
cves: ["CVE-2025-68645"]
severity: "high"
exploited: "in-the-wild"
kev: true
license: All rights reserved. Quote with attribution and a link.
---

# Zimbra CVE-2025-68645: Exploited /h/rest File Inclusion

**Verdict: Check exposure.** If any Zimbra server is below 10.1.13 or still on 10.0, patch or migrate now and check its logs for /h/rest probes; servers on a current 10.1 patch only need to stay current.

- **Who must act:** Administrators of self-hosted Zimbra 10.1 before 10.1.13 or any 10.0 release, especially internet-facing webmail, plus anyone still running the end-of-life 9.0 or 8.8.15 lines.
- **Who can relax:** Zimbra servers on 10.1.13 or later that are kept on the current patch, and organizations that do not run self-hosted Zimbra.
- **Affected:** Zimbra Collaboration 10.1.0 through 10.1.12; Zimbra Collaboration 10.0.0 through 10.0.17
- **Fixed:** Zimbra 10.1.13 (Nov 6, 2025) and later; the current 10.1 patch is recommended; Zimbra 10.0.18 (Nov 6, 2025), the last 10.0 release before end of life on Dec 31, 2025
- **CVEs:** CVE-2025-68645
- **CISA KEV:** yes · **Exploitation:** Exploited in the wild

## What to do

1. Check every mailbox node with su - zimbra -c 'zmcontrol -v'.
2. Upgrade to the current Zimbra 10.1 patch; 10.1.13 is the minimum for this CVE.
3. Migrate any 10.0, 9.0 or 8.8.15 server to 10.1, since those lines get no further fixes.
4. As a stopgap only, block requests to /h/rest that carry javax.servlet.include parameters at your reverse proxy or WAF.
5. If the server was exposed unpatched after mid-January 2026, review it for follow-on compromise and rotate its secrets.

### How to check if you are affected

- Grep Zimbra access logs for /h/rest requests containing javax.servlet.include (grep -E '/h/rest.*javax' /opt/zimbra/log/access_log.*).
- Treat 200 responses to those requests, especially for /WEB-INF/ paths, as successful file reads.
- Look for new or modified JSP files under /opt/zimbra/jetty_base/webapps/ and for unexpected admin logins after any hit.

## What happened

On November 6, 2025, Zimbra shipped 10.1.13 and 10.0.18 with a batch of security fixes. One is described as "an unauthenticated local file inclusion vulnerability in the RestFilter" ([10.1.13 notes](https://web.archive.org/web/20260905194355/https://wiki.zimbra.com/wiki/Zimbra_Releases/10.1.13), [10.0.18 notes](https://web.archive.org/web/20260905194355/https://wiki.zimbra.com/wiki/Zimbra_Releases/10.0.18)). Zimbra's [advisory table](https://web.archive.org/web/20260113200508/https://wiki.zimbra.com/wiki/Zimbra_Security_Advisories) credits devme4f of VNPT-VCI. As [heise](https://www.heise.de/en/news/Groupware-Zimbra-Updates-patch-several-security-vulnerabilities-11069679.html) noted, Zimbra gave few details at release.

The [CVE record](https://www.cve.org/CVERecord?id=CVE-2025-68645), published December 22, explains the bug. The RestFilter servlet in the Classic web UI mishandles request parameters, so "an unauthenticated remote attacker" can send requests to `/h/rest` that steer internal request dispatching and pull in arbitrary files from the WebRoot directory. CISA's ADP scores it CVSS 3.1 8.8 ([NVD](https://nvd.nist.gov/vuln/detail/CVE-2025-68645)). KEV calls it a "PHP remote file inclusion". Zimbra and the CVE record call it local file inclusion, and Zimbra's web tier runs on Java and Jetty, not PHP.

CISA added it to [KEV](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-68645) on January 22, 2026, with a February 12 deadline, and gave no details of the attacks. [CrowdSec](https://tracker.crowdsec.net/cves/CVE-2025-68645) released a detection rule on January 14 and first saw exploitation on January 19. The requests it documents pass `javax.servlet.include.servlet_path` to `/h/rest` to fetch files such as `/WEB-INF/web.xml`. CrowdSec told [SecurityWeek](https://www.securityweek.com/organizations-warned-of-exploited-zimbra-collaboration-vulnerability/) the activity looked like "highly targeted attacks" in "sophisticated, intelligence-driven campaigns", and that attempts were surging. [Beazley Security](https://beazley.security/alerts-advisories/critical-vulnerability-in-zimbra-webmail-cve-2025-68645) notes a public proof of concept on GitHub.

## Who is affected

Zimbra 10.1.0 through 10.1.12 and 10.0.0 through 10.0.17. The CVE names only those two lines. It does not say whether the older 9.0 and 8.8.15 code has the same flaw, and those lines stopped receiving fixes in 2025 and 2024 ([release table](https://web.archive.org/web/20260611101908/https://wiki.zimbra.com/wiki/Zimbra_Releases)). The 10.0.18 notes say Zimbra 10.0 reached end of life on December 31, 2025, so 10.0.18 is that line's last fix.

## Do you really need to act?

If you are on 10.1.13 or later and keep up with patches, this bug is already closed. Otherwise, yes. It needs no login, works over the same HTTPS port as webmail, and has a public exploit. Exploitation started less than a month after the CVE was published. On its own, the bug reads files from the web application. It is not documented as direct code execution. But SecurityWeek notes it can expose internal paths and configuration that help an attacker go further when chained with other weaknesses. A mail server is a valuable foothold, so close the bug and then check whether anyone used it.

## What to do now

1. Check each mailbox node: `su - zimbra -c "zmcontrol -v"`.
2. Upgrade to the current 10.1 patch. Zimbra released [10.1.20](https://blog.zimbra.com/2026/07/patch-release-update-zimbra-10-1-20/) in July 2026; 10.1.13 is the minimum for this CVE.
3. Migrate 10.0, 9.0 and 8.8.15 servers to 10.1.
4. As a stopgap only, not vendor guidance: at your reverse proxy or WAF, block `/h/rest` requests that carry `javax.servlet.include` parameters.
5. If the server was exposed and unpatched after mid-January 2026, review it and rotate its secrets.

## How to tell if you were hit

Search the access logs for the documented pattern: `grep -E '/h/rest.*javax' /opt/zimbra/log/access_log.*`, and the proxy log `/opt/zimbra/log/nginx.access.log` if you use the Zimbra proxy. A 200 response, especially for `/WEB-INF/` paths, means a file was served. After any hit, look for new or changed JSP files under `/opt/zimbra/jetty_base/webapps/`, unexpected admin logins, and new accounts. Rotate any credentials or keys stored in files the attacker could have read.

## Timeline

- Nov 6, 2025 — Zimbra releases 10.1.13 and 10.0.18 with the fix.
- Dec 22, 2025 — CVE-2025-68645 is published.
- Dec 31, 2025 — Zimbra 10.0 reaches end of life.
- Jan 14, 2026 — CrowdSec releases a detection rule.
- Jan 19, 2026 — CrowdSec first sees exploitation.
- Jan 22, 2026 — CISA adds the CVE to KEV.
- Feb 12, 2026 — CISA's remediation deadline for federal agencies.

## Sources

1. [Zimbra — Zimbra Daffodil 10.1.13 release notes (archived)](https://web.archive.org/web/20260905194355/https://wiki.zimbra.com/wiki/Zimbra_Releases/10.1.13)
2. [Zimbra — Zimbra Daffodil 10.0.18 release notes (archived)](https://web.archive.org/web/20260905194355/https://wiki.zimbra.com/wiki/Zimbra_Releases/10.0.18)
3. [Zimbra — Security Advisories (archived Jan 2026)](https://web.archive.org/web/20260113200508/https://wiki.zimbra.com/wiki/Zimbra_Security_Advisories)
4. [CVE record — CVE-2025-68645](https://www.cve.org/CVERecord?id=CVE-2025-68645)
5. [NVD — CVE-2025-68645](https://nvd.nist.gov/vuln/detail/CVE-2025-68645)
6. [CISA — Known Exploited Vulnerabilities: CVE-2025-68645](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-68645)
7. [CrowdSec — Live Exploit Tracker: Zimbra LFI (CVE-2025-68645)](https://tracker.crowdsec.net/cves/CVE-2025-68645)
8. [Zimbra — Zimbra Releases and lifecycle (archived Jun 2026)](https://web.archive.org/web/20260611101908/https://wiki.zimbra.com/wiki/Zimbra_Releases)
9. [Zimbra — Patch Release Update: Zimbra 10.1.20 (Jul 20, 2026)](https://blog.zimbra.com/2026/07/patch-release-update-zimbra-10-1-20/)
10. [Beazley Security — Critical vulnerability in Zimbra webmail under active exploitation](https://beazley.security/alerts-advisories/critical-vulnerability-in-zimbra-webmail-cve-2025-68645)
11. [heise — Groupware Zimbra: Updates patch several security vulnerabilities (Nov 7, 2025)](https://www.heise.de/en/news/Groupware-Zimbra-Updates-patch-several-security-vulnerabilities-11069679.html)
12. [SecurityWeek — Organizations warned of exploited Zimbra Collaboration vulnerability (Jan 23, 2026)](https://www.securityweek.com/organizations-warned-of-exploited-zimbra-collaboration-vulnerability/)

---
Source page: https://erroneo.us/security/briefs/zimbra-cve-2025-68645-restfilter-file-inclusion/ · Security Digest: https://erroneo.us/security/ · More: https://erroneo.us/llms.txt