Zimbra developers released security updates to fix vulnerability that affects all versions of Zimbra. An attacker could exploit some of these vulnerabilities (CVE-2025-66376, CVE-2025-67809, CVE-2025-68645) to trigger cross-site scripting, denial of service condition, execute arbitrary files from the WebRoot directory, security restriction bypass and sensitive information disclosure on the targeted system.

Security vulnerability is fixed in the following Zimbra versions:

• Zimbra Daffodil 10.1.13

• Zimbra Daffodil 10.0.18

Source: zimbra.com