Zimbra OnlyOffice can turn a public Briefcase link into a shell

Zimbra’s OnlyOffice document-editing path just picked up a critical, unauthenticated remote-code-execution bug. If users can share Briefcase files publicly and OnlyOffice is turned on, an attacker who can reach one of those documents does not need a mailbox password to write files and run commands as the zimbra user.

A public Briefcase link should not be a shell on your mail server.

What happened

CVE-2026-93643 (assigned by Rapid7, published September 25, 2026) covers a path-traversal issue in the Zimbra Collaboration Suite OnlyOffice / document-editing integration. When OnlyOffice is available, an unauthenticated attacker who can reach an existing supported public Briefcase document can abuse unsigned save fields on the /downloadas request path to write arbitrary files and execute commands as the zimbra OS user.

Zimbra’s security advisories page lists the OnlyOffice unauthorized file-write / RCE fix in ZCS 10.1.21 (credited to Jonah Burgess of Rapid7), alongside a second OnlyOffice server-side JavaScript injection issue for authenticated users and several Classic Web Client XSS fixes in the same release. CVSS for 93643 is scored 9.8 (AV:N/AC:L/PR:N/UI:N).

Why it matters

Mail servers are identity hubs: address books, password-reset flows, and a path into every inbox. Code execution as zimbra is enough to read mail, plant filters, and pivot. The precondition is narrower than a blind Internet RCE — OnlyOffice plus a reachable public Briefcase document — but many collaboration deployments turn both on for “easy sharing,” which is exactly how this becomes a Monday inventory job.

What to do first

• Upgrade Zimbra Collaboration Suite to 10.1.21 (or later) on every mailbox / proxy node that serves OnlyOffice.
• Until you can patch: disable OnlyOffice / document editing, or remove public sharing on Briefcase documents that use supported Office formats.
• Inventory public Briefcase links and revoke any that do not need to be anonymous.
• Review web logs for unauthenticated /downloadas hits tied to Briefcase documents around the disclosure window.
• If OnlyOffice was exposed and unpatched: treat the host as suspicious — check for unexpected files under Zimbra paths, new cron / startup entries as the zimbra user, and outbound connections from mailbox nodes.

Details

• CVE: CVE-2026-93643 — path traversal / incorrect authorization (CWE-22, CWE-863) → unauthenticated RCE as zimbra
• Product: Zimbra Collaboration Suite with OnlyOffice / document editing; public Briefcase document required
• Fixed: ZCS 10.1.21
• Published: 2026-09-25 (Rapid7 CNA)
• Related in 10.1.21: additional OnlyOffice authenticated command-exec fix; multiple Classic UI XSS; password-recovery predictability fix
• KEV: not listed as of research time — still patch-priority because it is unauthenticated RCE

Hunt / verify

• Confirm version: zmcontrol -v (or Admin Console) shows 10.1.21+.
• Check whether document editing / OnlyOffice zimlet or service is enabled.
• List publicly shared Briefcase documents; revoke anonymous access where possible.
• Grep proxy / mailbox access logs for /downloadas from unexpected sources.

Zimbra to 10.1.21 today (or disable OnlyOffice + public Briefcase); hunt /downloadas on unpatched mail nodes; revoke anonymous Briefcase shares you do not need.

Sources

• Zimbra Security Advisories (10.1.21 OnlyOffice fixes)
• CVE.org — CVE-2026-93643
• OpenCVE — CVE-2026-93643 details

George Bailey

George Bailey is the byline of the CyberExperts editorial desk, the team behind the CyberExperts Daily Brief. The desk covers vulnerabilities, breaches and security news from vendor advisories, CISA alerts and other primary sources, and links those sources in every story. Questions or corrections: [email protected].