CVE-2025-66376: Zimbra Collaboration Suite Classic UI Vulnerable to CSS @import XSS Attack

Affected Product: Synacor Zimbra Collaboration Suite (ZCS) — Classic UI Vulnerability Type: Cross-Site Scripting (XSS) via CSS @import Directive Injection CISA KEV Deadline: Federal agencies must patch by April 1, 2026

Vulnerability Overview

CVE-2025-66376 is a stored or reflected cross-site scripting vulnerability in Synacor's Zimbra Collaboration Suite, specifically within the Classic UI interface. The flaw stems from inadequate sanitization of CSS @import directives embedded in incoming HTML email content. Zimbra's rendering engine fails to strip or neutralize these directives before displaying email content in a user's browser, providing attackers a direct path to JavaScript execution within a victim's authenticated session.

The attack vector is network-based and requires no authentication. An unauthenticated remote attacker needs only to send a crafted email to a Zimbra user. When that user opens the message in the Classic UI, the malicious payload executes automatically.

Technical Details

The root cause is the absence of a sanitization control on CSS @import rules during HTML email processing. An attacker constructs an HTML email containing one or more @import statements that reference attacker-controlled external stylesheets. Those stylesheets carry JavaScript payloads, which the browser executes in the context of the victim's authenticated Zimbra session.

Because execution occurs within the victim's session context, the attacker inherits the victim's session privileges at the moment of payload execution. This means the browser-side attack runs with full access to the user's Zimbra session token, mail data, contacts, and any delegated mailbox permissions.

The CSS @import mechanism is particularly effective as an injection vector because many content security policies and email sanitizers focus on explicit <script> tags and JavaScript event handlers, while CSS-based loading mechanisms receive less scrutiny in legacy email platform implementations.

Real-World Impact

Exploitation of CVE-2025-66376 enables the following concrete outcomes:

Session Hijacking: The attacker extracts the victim's session cookie or authentication token, allowing persistent access to the mailbox without further interaction from the victim.

Credential Theft: A JavaScript payload can render a convincing in-UI prompt that captures plaintext credentials and exfiltrates them to an attacker-controlled endpoint.

Mailbox Access and Data Exfiltration: With session-level access, an attacker can read, forward, delete, or exfiltrate emails and attachments. Shared or delegated mailboxes accessible to the victim are equally exposed.

Lateral Movement via Internal Communications: Compromised mailboxes allow an attacker to send internal phishing emails that appear legitimate, escalating access within an organization.

Zimbra is widely deployed across government agencies, telecommunications companies, and enterprises, particularly in regions where it serves as a primary collaboration platform. The CISA Known Exploited Vulnerabilities catalog inclusion confirms this flaw carries sufficient real-world risk to warrant mandatory federal remediation.

Affected Versions

The vulnerability affects Zimbra Collaboration Suite installations running the Classic UI. Organizations running the Modern UI may have different exposure, but Synacor's advisory should be consulted to confirm version-specific scope. Administrators who have not explicitly disabled the Classic UI remain exposed.

Patching and Mitigation

Primary Remediation: Apply Synacor's official security update for Zimbra Collaboration Suite immediately. Check the Synacor Zimbra security advisories page for the specific patch version addressing CVE-2025-66376.

Gateway-Level Control: Deploy a rule at the email gateway or secure email gateway (SEG) to block or strip inbound emails containing CSS @import directives in HTML bodies. This reduces attack surface while patch deployment is completed across all ZCS nodes.

Disable Classic UI: If the Classic UI is not operationally required, disable it and enforce use of the Modern UI. This eliminates the specific rendering code path targeted by this vulnerability.

Log Auditing: Review ZCS mail processing logs for emails containing @import strings. Cross-reference against user session logs for logins from unfamiliar IP addresses, unusual user-agents, or session activity occurring immediately after a user opened an email. Prioritize accounts with administrative or delegated mailbox privileges.

Content Security Policy Enforcement: Ensure the ZCS web application serves a Content Security Policy header that blocks external stylesheet loading. A strict style-src directive limits the browser's ability to fetch attacker-controlled CSS resources even if an @import directive reaches the rendering engine.

Federal Agency Compliance: CISA has mandated remediation by April 1, 2026, under Binding Operational Directive 22-01. Federal agencies operating ZCS must treat this as a hard deadline, not a target.

Summary

CVE-2025-66376 gives unauthenticated remote attackers JavaScript execution inside authenticated Zimbra sessions by exploiting the Classic UI's failure to sanitize CSS @import directives in HTML emails. The impact includes session hijacking, credential theft, and full mailbox compromise. Apply Synacor's patch, enforce gateway filtering, and audit session logs immediately.