This critical vulnerability in Synacor Zimbra Collaboration Suite (ZCS) is currently being exploited in the wild and allows unauthenticated remote attackers to achieve full system compromise.

The flaw is a Local File Inclusion (LFI) vulnerability residing in the RestFilter servlet of the Webmail Classic UI. An unauthenticated attacker can manipulate request parameters sent to the /h/rest endpoint to bypass security controls and include arbitrary files from the WebRoot directory.

The ability for an unauthenticated attacker to include arbitrary files presents a severe risk to confidentiality, integrity, and availability. Successful exploitation can lead to the exposure of sensitive configuration files, credential theft, or full remote code execution, justifying the high CVSS score of 9.5. This vulnerability poses an existential threat to the security of the mail environment and any data hosted within the ZCS infrastructure.

Immediate Action: Administrators must apply the vendor-supplied security patches provided by Synacor immediately to remediate the RestFilter servlet logic.

Proactive Monitoring: Monitor server access logs for anomalous requests directed at the /h/rest endpoint, specifically looking for path traversal sequences or attempts to access non-standard system files.

Compensating Controls: Deploy Web Application Firewall (WAF) rules designed to detect and block malicious payloads targeting the RestFilter servlet and restrict external access to the Webmail Classic UI where possible.

Public Exploit Available: Yes (multiple public proof-of-concept repositories available on GitHub).

Due to the confirmed active exploitation and the critical nature of the flaw, organizations must prioritize the immediate application of patches for ZCS 10.0 and 10.1. If patching is not immediately feasible, restrict public access to the affected web interface until remediation is complete to prevent unauthorized access and potential system takeover.