ZDI 2026-02-25

ZDI-26-130: IceWarp collaboration Directory Traversal Information Disclosure Vulnerability

CVE-2026-2493

Machine-generated analysis · WAYSCloud LLM

The vulnerability permits unauthenticated remote attackers to disclose sensitive information via a directory traversal flaw in IceWarp's collaboration component.

Context

The affected product is IceWarp, a collaboration platform. The vulnerability is a directory traversal issue that leads to information disclosure. Authentication is not required to exploit the vulnerability. The ZDI assigned a CVSS score of 7.5, indicating a medium to high severity impact.

Operator considerations

Check: Identify systems running IceWarp collaboration software, particularly those exposed to untrusted networks.

From Zero Day Initiative ↗

This vulnerability allows remote attackers to disclose sensitive information on affected installations of IceWarp. Authentication is not required to exploit this vulnerability. The ZDI has assigned a CVSS rating of 7.5. The following CVEs are assigned: CVE-2026-2493.

Read the full advisory on ZDI →