CVE-2025-25064

CVE-2025-25064 is a SQL injection flaw in the ZimbraSync Service SOAP endpoint of Zimbra Collaboration Suite, caused by insufficient sanitization of a user-supplied parameter. An authenticated attacker triggers it by sending a crafted SOAP request with malicious content in a specific parameter, allowing arbitrary SQL queries to be injected into the backend database. Successful exploitation can let the attacker retrieve email metadata from the database, with the high CVSS 8.8 score reflecting potentially serious confidentiality, integrity and availability impact. It affects Zimbra Collaboration 10.0.x prior to 10.0.12 and 10.1.x prior to 10.1.4, so any organization running those branches with the sync service exposed is in scope. As of the advisory date there is no public proof-of-concept, it is not listed in CISA KEV, but its EPSS of 36.7% (98th percentile) indicates an elevated likelihood of exploitation attempts within 30 days, and fixes were shipped in Zimbra's recent security release alongside patches for stored XSS and SSRF issues.

What to do: Upgrade Zimbra Collaboration to 10.0.12 (for the 10.0.x branch) or 10.1.4 (for the 10.1.x branch), or later, applying the current security patch release which also fixes related stored XSS and SSRF issues. Because exploitation requires authentication, review for suspicious or compromised accounts and restrict exposure of the ZimbraSync Service SOAP endpoint until patched. Monitor vendor advisories for updates on exploitation activity given the elevated EPSS score.