Exploit for PHP Remote File Inclusion in Synacor Zimbra Collaboration Suite

CVE-2025-68645

githubexploit · 2026-08-07

Description

PHP remote file inclusion exploit for Synacor Zimbra Collaboration Suite (CVE-2025-68645) with POC.

Entry point

Parameterjavax.servlet.include.servlet_path · query param

Pathh/rest

LFI via RestFilter on /h/rest allowing inclusion of internal files from WebRoot

Affected Synacor Zimbra Collaboration Suite versions

Synacor Zimbra Collaboration Suite< 10.0.18, 10.1.13

All known vulnerabilities by product

Zimbra Collaboration

CVSS 8.8 for CVE-2025-68645

8.8

HIGH SEVERITY

Version 3.1

VectorCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Attack Vector:NETWORK

Attack Complexity:LOW

Privileges Required:NONE

User Interaction:REQUIRED

Scope:UNCHANGED

Confidentiality:HIGH

Integrity:HIGH

Availability:HIGH

Working code

48%confidence this exploit runs

Based on 1 file(s) in the source

EPSS Score

31.8%higher than 98.1% of all CVEs

Updated 2026-08-17

Exploit Details

Modified:2026-08-07 17:48

Last Seen:2026-08-07 17:50

Reporter:Ashwesker

Last commit:2026-08-07

Other exploits for CVE-2025-68645

Exploit for PHP Remote File Inclusion in Synacor Zimbra_Collaboration_Suite

2026-05-06 HarisAidhinGITHUB

Exploit for PHP Remote File Inclusion in Synacor Zimbra_Collaboration_Suite

2026-02-21 CMEGh0stX47GITHUB

Exploit for PHP Remote File Inclusion in Synacor Zimbra_Collaboration_Suite

2026-02-10 faysalferdousGITHUB

📄 Zimbra Collaboration 10.0 / 10.1 Local File Inclusion

2026-01-02 MaxMnMl, sirifu4k1PACKETSTORM

Exploit for CVE-2025-68645

2026-01-01 MaxMnMlGITHUB

Exploit Code

README7 lines

## https://sploitus.com/exploit?id=98F7E85D-8F3D-5F46-ABA3-DEA3AFA0B878
# Ashwesker-CVE-2025-68645
POC BLH Magelang CSIRT 2026 by babyrootkid

# ⚠️ Repository Moved
This repository has been relocated to the new official repository:
👉 (https://github.com/MaxMnMl/zimbramail-CVE-2025-68645-poc)

Exploit Code

Share

Share on social media: