Rapid7 Vulnerability & Exploit Database

UnRAR Path Traversal in Zimbra (CVE-2022-30333)

Back to Search

UnRAR Path Traversal in Zimbra (CVE-2022-30333)



This module creates a RAR file that can be emailed to a Zimbra server to exploit CVE-2022-30333. If successful, it plants a JSP-based backdoor in the public web directory, then executes that backdoor. The core vulnerability is a path-traversal issue in unRAR that can extract an arbitrary file to an arbitrary location on a Linux system. This issue is exploitable on the following versions of Zimbra, provided UnRAR version 6.11 or earlier is installed: * Zimbra Collaboration 9.0.0 Patch 24 (and earlier) * Zimbra Collaboration 8.8.15 Patch 31 (and earlier)


  • Simon Scannell
  • Ron Bowes




x86, x64


Module Options

To display the available options, load the module within the Metasploit console and run the commands 'show options' or 'show advanced':

msf > use exploit/linux/http/zimbra_unrar_cve_2022_30333
msf exploit(zimbra_unrar_cve_2022_30333) > show targets
msf exploit(zimbra_unrar_cve_2022_30333) > set TARGET < target-id >
msf exploit(zimbra_unrar_cve_2022_30333) > show options
    ...show and set options...
msf exploit(zimbra_unrar_cve_2022_30333) > exploit

Time is precious, so I don’t want to do something manually that I can automate. Leveraging the Metasploit Framework when automating any task keeps us from having to re-create the wheel as we can use the existing libraries and focus our efforts where it matters.

– Jim O’Gorman | President, Offensive Security