# CVE-2026-66911: Zimbra stored XSS via Content-Location MIME header in attachments

Source: https://junglewise.ai/threats/cve-2026-66911-zimbra-is-vulnerable-to-stored-cross-site-scripting-xss-via-the  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-29. Updated: 2026-10-29  
License: CC BY 4.0 with a link back

CVE-2026-66911 · Severity: info · Published 2026-10-29

Zimbra Collaboration is a messaging and collaboration platform used by organizations for email, calendar, and shared storage. A stored cross-site scripting vulnerability allows an attacker to send a malicious email with a crafted attachment; when a victim opens it in the web interface and clicks the attachment name, attacker-controlled JavaScript executes in the victim's browser, potentially stealing session data or performing actions on their behalf.

Vendors: [Synacor](https://junglewise.ai/threats/vendors/synacor).

## Quick answers

**Is CVE-2026-66911 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-66911 being exploited in the wild.

**How severe is CVE-2026-66911?** Informational severity, published 29 October 2026.

**Which products and versions are affected?** Synacor Zimbra Collaboration before 10.1.21.

**Is there a fix for CVE-2026-66911?** Yes: fixed in 10.1.21. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-66911 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-66911?** Check whether you run Synacor Zimbra Collaboration at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in 10.1.21

## Technical details

A stored XSS vulnerability exists in Zimbra's email attachment handling due to insufficient sanitization of the Content-Location MIME header, which an attacker can set to a javascript: URI. An unauthenticated remote attacker sends a crafted email; when the victim opens it in the Zimbra web interface and clicks the attachment link, the JavaScript payload executes with the victim's privileges. The vulnerability was patched in version 10.1.21.

## Affected products

- Synacor Zimbra Collaboration before 10.1.21

## Timeline

- 2026-10-29: disclosed

## References

- [https://cert.pl/en/posts/2026/10/CVE-2026-66911](https://cert.pl/en/posts/2026/10/CVE-2026-66911)
- [https://wiki.zimbra.com/wiki/Zimbra_Security_Advisories](https://wiki.zimbra.com/wiki/Zimbra_Security_Advisories)

## Related threats

- [Zimbra Collaboration stored XSS in From header during reply composition](https://junglewise.ai/threats/cve-2026-66912-zimbra-is-vulnerable-to-stored-cross-site-scripting-xss-via-the)