This stored XSS in Zimbra's Classic Web Client deserves prioritization beyond what its CVSS 6.1 suggests. The email delivery mechanism fundamentally changes the threat model. Unlike reflected or DOM-based XSS that requires tricking users to a malicious page, this vulnerability arrives in the inbox as an expected attachment—something the user may have requested, in a context of established professional communication. The social engineering barrier collapses entirely.
The 'attachment content' phrasing is critical. This isn't a filename-based bypass; the sanitization failure occurs in the inline preview rendering pipeline, meaning the payload lives inside the file content itself. Filename extension filters and upload-time validation won't catch it. The attack surface is specifically the preview rendering pipeline, and the fix likely addressed the immediate content-type that triggered this CVE—not the entire preview stack. SVG, PDF with embedded JavaScript, and other renderable formats in that pipeline likely remain in scope for sister vulnerabilities.
The Classic Web Client specificity is a migration-era exposure you need to audit. Zimbra's transition to the AJAX client creates a population running on deprecated infrastructure that receives minimal security attention. Both clients share the attachment upload and preview backend, but engineering resources have shifted to the modern client. Your question shouldn't be 'what percentage of users are on Classic'—it should be 'which of our monitoring tools actually have coverage on Classic traffic?' because those answers often differ. Email security gateways typically assume inbound mail is pre-scanned; this CVE violates that assumption by embedding the payload in attachment content that preview rendering renders executable.
The blast radius extends beyond the mailbox. Zimbra typically integrates with LDAP/AD for authentication, hosts adjacent file storage, and often partially owns SSO infrastructure. Session compromise here may be reusable against the admin console, connected storage, or identity systems. The CVSS 6.1 scores the technical payload without scoring Zimbra's architectural centrality—a compromise node with high network proximity to the organization's collaboration hub. Organizations running Zimbra, particularly in regulated sectors where spear-phishing ROI is higher, should weight this CVE above its numerical score.