Zimbra Releases/10.1.17 - Zimbra :: Tech Center (original) (raw)
Zimbra Daffodil (v10.1.17) Patch Release
Release Date: May 28, 2026
Security Fixes
| Summary | CVE-ID | CVSS Score |
|---|---|---|
| Fixed an authorization bypass in delegated send handling that could allow authenticated users to send emails impersonating other users. | TBD | TBD |
| Addressed a stored XSS vulnerability in the Classic UI where malicious email attachments could execute script content when previewed. | TBD | TBD |
| Addressed an authenticated LFI vulnerability in the Briefcase document feature via the packages parameter. | TBD | TBD |
| Addressed an unauthenticated LFI vulnerability in the Classic UI via one of the input parameter. | TBD | TBD |
| Addressed a Cross-Site Request Forgery (CSRF) vulnerability in the EWS endpoint that could allow unauthorized actions on behalf of authenticated users. | TBD | TBD |
| Addressed weak RNG for the zimbraDocumentEditingJwtSecret that could allow offline brute-forcing of the JWT signing secret. | TBD | TBD |
What's New
Ubuntu 24 Support (GA)
With this release Ubuntu 24 Support (GA) is available.
Modern Web App
General
- Introduced an enhanced event creation experience in the Modern WebClient with a streamlined layout, reduced scrolling, and improved efficiency for quick scheduling. The updated flow includes an integrated availability view, clearer visual hierarchy, and better organization of event details for a more intuitive user experience.
- Upgraded the application runtime from Electron 37 to Electron 41, bringing improved security, performance, and compatibility with newer Chromium and Node.js versions.
- Enhanced the Modern WebClient email composer with a cleaner and more powerful drafting experience, including improved recipient fields, subject validation, upgraded formatting toolbar, and better attachment handling with drag-and-drop and previews. Added draft actions, message settings (priority, signatures, read receipt, plain text), improved paste behavior, multi-signature support, and a full-pane responsive layout with autosave and validation improvements.
- Enhanced the Modern WebClient subject header with new capabilities to improve conversation handling and visibility:
Added Collapse All action (available in conversation view only) Added Go to Latest action (available in conversation view only) Introduced Open in New Tab option for quick access Display Total Messages Count in the header Unread Count indicator added
These enhancements improve navigation efficiency and provide better conversation-level context.
- Enhanced the Modern WebClient right-click context menu by adding icons to all key actions, aligning it with the top action bar for a consistent experience.
- Improved the Modern WebClient time picker with a streamlined scroll-based selector for hours, minutes, and AM/PM, using default 15-minute increments (00, 15, 30, 45) while still supporting custom minute entry.
- Introduced “Suggest a Time” in the Modern WebClient calendar, allowing organizers to view participant availability and get optimal meeting time suggestions while creating an invite. The feature updates dynamically when participants are added, highlights available slots based on duration, and lets users select or adjust the proposed time.
- Improved attachment handling in the Modern WebClient by introducing a dedicated top panel in thread view for consistent visibility.
- Enhanced the Modern WebClient to keep the Reply, Reply All, and Forward action bar pinned and always visible while scrolling through email threads, enabling quicker actions without needing to navigate within long conversations.
- Introducing a powerful new voice-enabled text composer in the Modern WebClient, designed to boost productivity and accessibility by allowing users to draft emails using speech-to-text. Available across new, reply, and forward actions, it supports system language detection, spoken punctuation, and seamless cursor-based insertion. The feature includes an in-composer microphone for quick access and can be managed from settings.
This feature is disabled by default and can be enabled by admins at the COS or account level using the zimlet "zimbra-zimlet-voice-composer". Once enabled, the microphone option becomes available in the email composer, and users can control it from their Mail settings without requiring a refresh
- Introduced a new Inbox View Order setting in the Modern WebClient, allowing users to choose how email threads are displayed. The setting is available under Settings → Viewing Email and provides two options: “Oldest → Newest” and “Newest → Oldest” (default behavior). When the newer option is selected, the latest messages appear at the top of each thread, while maintaining all existing thread behavior, including read/unread status, message actions, and conversation integrity.
Classic Web App
- Introduced support to display the QR code on the login page when 2FA is enforced, allowing users to set up authentication directly during login instead of only through user preferences.
Fixed Issues
Zimbra Collaboration
- An issue where zmpurgeoldmbox removed blobs after mailbox migration has been resolved. Previously, cleanup on the source server deleted blobs still in use by the migrated mailbox, making data inaccessible and causing email data loss. With this fix, zmpurgeoldmbox no longer deletes external blobs that are still referenced by active mailboxes unless explicitly deleted using the appropriate flag. This ensures safe mailbox migration in environments using external storage.
- An issue where local contacts did not appear in autocomplete suggestions when zimbraHideInGal was set to TRUE has been resolved. Previously, local contacts were incorrectly filtered out, even though the setting should apply only to GAL entries. With this fix, local contacts are always included in autocomplete results regardless of GAL visibility settings, restoring expected behavior.
- Mailboxes could grow far beyond their configured quota due to repeated IMAP copy operations to the Trash folder. This issue has been resolved. Previously, quota checks were not applied to IMAP copy/move operations to Trash, allowing excessive mailbox growth and high disk usage. With this fix, a configurable soft quota limit controls how much data can be added to Trash, ensuring mailbox size remains within defined limits while still allowing normal delete operations.
Modern Web App
General
- A bug in filters that caused duplicate entries when creating or editing filters has now been fixed. Previously, reopening and closing the filter window multiple times added repeated values.
- An issue was identified in Zimbra Desktop where the folder bar did not retain its adjusted width after restarting or reloading. Users had to manually click the bar frame to restore it. This has now been fixed, ensuring the folder bar width persists correctly across sessions.
- An issue was identified in the Modern WebClient where certain attachments were not displayed when forwarding emails. This has now been fixed, ensuring attachments are retained and displayed properly and email content appears as expected during forwarding.
- Previously, the menu width in the Modern WebClient was not retained after navigating between tabs or refreshing the page. This has now been fixed, ensuring the menu size is preserved consistently.
- Users experienced an issue in the Modern WebClient where the search tab could not be closed after replying to an email, requiring a browser refresh. This has now been fixed, allowing search tabs to close normally after performing actions like reply.
- Print function in the Modern WebClient displayed a blank preview when attempting to print emails using Ctrl+P. This has now been fixed, ensuring email content loads correctly in the print preview and can be printed as expected.
- ‘R’ (reply) keyboard shortcut in the Modern WebClient did not consistently place the cursor in the compose area after the first use within a session. This has now been fixed, ensuring the cursor is automatically focused in the reply body every time, allowing users to start typing immediately.
- An inconsistency was found where the Search Highlighter Zimlet did not highlight search terms in the preview pane. This has now been fixed, ensuring matching keywords are correctly highlighted when viewing emails from search results in the Modern WebClient.
- In Modern WebClient when user was opening a PDF or document attachments in full-screen mode it prevented users from exiting full-screen, and zoom controls became unresponsive. This has now been fixed, allowing users to exit full-screen mode and use zoom functions normally when previewing attachments.
- Editing and saving filters in the Modern WebClient could cause duplicate rules to appear when reopening the filter in advanced mode. This has now been fixed, ensuring only the intended filter is retained and preventing unintended duplication during edits.
- PDF attachments with multiple pages did not display all pages in the preview within the Modern WebClient. This has now been fixed, ensuring all pages of a PDF are rendered correctly during preview.
- An inconsistency was found in the Modern WebClient where, during reply or forward actions, email addresses in the previous thread displayed only the first name instead of the full name. This has now been fixed, ensuring full names are shown consistently across email threads.
- Emails printed from the Modern WebClient were truncated, with the last lines of content missing at default print settings across browsers. This has now been fixed, ensuring complete email content is included in print output without requiring scale adjustments.
- Inline images in calendar appointment notes were not displayed in the Modern WebClient when the content contained only an image without text. This has now been fixed, ensuring images render correctly in appointments regardless of accompanying text.
- Certain email messages remained stuck in a loading state in the Modern WebClient across browsers. This has now been fixed, ensuring messages load and display correctly without getting stuck.
- An issue was observed where .p7s attachments were not visible in received emails in the Modern WebClient. This has now been fixed, ensuring these attachments are displayed and accessible as expected.
- Attachments could not be downloaded in the Zimbra mobile app and remained stuck in a loading state. This has now been fixed, ensuring attachments download successfully on mobile devices.
- An enhancement in the Modern WebClient where all unread messages in a thread are automatically expanded when opened, improving visibility. Additionally, an issue where threads were being incorrectly marked as read has been resolved, ensuring accurate unread status is maintained.
Admin Web Console
- German text appeared garbled in the Admin Console under certain sections. This has now been fixed, ensuring proper rendering of German language content across the interface.
- French translations in the Backup/Restore section of the Admin Console were incorrect. This has now been fixed.
Zimbra Connector for Outlook
- Users can now use their recovery email as an additional factor for two-factor authentication in ZCO, enhancing account security. During login or profile setup, a one-time code is sent to the recovery email for verification, with an option to resend if needed. Users can choose a preferred 2FA method (email or authenticator app) and switch between methods if required from Zimbra web client. Updates to 2FA preferences take effect immediately and apply to subsequent login attempts.
- An issue where email bodies intermittently disappeared when sending messages created from .msg files in Outlook has been resolved. Previously, emails sent using .msg files could lose their body content during send. With this fix, message content is consistently preserved during send operations. Additional handling improvements ensure reliable behavior when using .msg templates with attachments.
- An issue where emails forwarded using Outlook with ZCO appeared distorted or incorrectly formatted in Zimbra Webmail and the Outlook inbox - has been resolved. Previously, forwarded messages could display improperly due to MIME formatting issues. With this fix, email structure and formatting are preserved correctly when forwarding messages through Outlook with ZCO.
- Emails sent using delegated Send As in Outlook with ZCO were not being saved in the delegated account’s Sent folder. This issue has been resolved. Previously, sent messages were only saved in the sender’s Sent folder, despite the “Save a copy of sent messages” setting being enabled. With this fix, sent emails are correctly saved in both the sender’s and delegated account’s Sent folders, aligning with expected behavior.
ActiveSync
- An issue where contacts did not sync correctly in the Samsung Email app when the number of local contacts exceeded 1000 has been resolved. Previously, synchronization could fail or remain incomplete for large contact sets, while other clients were unaffected. With this fix, contacts sync reliably for larger datasets in the Samsung Email app, ensuring consistent behavior across devices.
Auth
- LDAP Authentication
SSHA256 Password Hash Authentication Failure On RHEL 9 and Ubuntu 22 systems, {SSHA256} password hashes may be generated incorrectly, causing authentication failures after password changes or migrations. Workaround: Reset affected user passwords to regenerate valid hashes. Note: Passwords created prior to this issue may continue to work; new passwords after the fix are generated correctly.
Calendar
- An issue where calendar events disappeared on iPhone after accepting an invite when zimbraPrefCalendarAutoAddInvites was set to FALSE has been resolved. Previously, accepting an invite could remove the event from the iOS Calendar and no response was sent to the organizer. With this fix, events remain visible after acceptance and responses are handled correctly, aligning with expected behavior on iOS devices.
Chat
- Opening multiple Advanced Chat sessions in separate browser tabs caused chat to become slow and unresponsive across tabs. This has now been fixed, ensuring that when Chat is already open, focus shifts to the existing tab instead of opening new ones, preventing performance issues.
- User avatar images in chat were not loading in the Modern WebClient, resulting in broken icons. This has now been fixed, ensuring avatar images load correctly in the chat panel.
- Mailboxes could grow significantly due to repeated IMAP copy operations from Apple Mail clients. This issue has been resolved. Previously, certain Apple Mail clients could enter a loop and repeatedly copy messages into folders, leading to excessive duplication, rapid mailbox growth, and increased storage usage. With this fix, duplicate copy operations are handled more effectively, preventing uncontrolled mailbox size increases.
Local configs added:
imap_suggested_batch_copy_size: Number of messages to process per batch during IMAP COPY operations. Default value is set to 5
imap_in_progress_response_thread_pool_size: Max threads in pool for sending InProgress response to client when IMAP COPY operation is in progress. Default value is set as 10
imap_in_progress_response_thread_keep_alive: Time in seconds for the thread sending InProgress response to be kept alive before being terminated. Default values is set to 15 seconds.
- After opening an attachment in full preview in a new tab and navigating back, the Mail tab failed to load until a manual refresh. This has now been fixed, ensuring users are returned to the Mail view correctly without requiring a refresh.
Backup Restore
- When Cross Session Deduplication (CSD) is enabled, creating a v1 backup using CLI options such as --nodedupe --zip results in the backup being labeled as a CSD backup, even though it is internally generated as a v1 backup. This mismatch can cause confusion for users, as the backup behavior and structure follow v1 semantics while the label indicates CSD.
Known Issues
- In v10.1.17, the Modern Webclient and Classic Webclient will display different Zimbra build numbers. The Modern Webclient displays 10.1.17_GA_4874 (build 20260428082610) while the Classic Webclient displays 10.1.17_GA_4873 (build 20260427131514). This behavior is due to differences in build packaging and does not impact functionality, compatibility, or the applied patch level.
Backup & Restore
- When restoring an existing account that uses external Amazon S3 blob storage (primary, secondary, unified, or non-unified), duplicate blobs may be created on the S3 volume if the account is restored without first deleting the existing account. During restore, new blob objects are created for the restored data, while the previously existing blobs on external storage are not removed and remain unused on the S3 volume.
Packages
The package lineup for this release is:
zimbra-patch -> 10.1.17.1778766453-2 zimbra-lds-patch -> 10.1.17.1777365774-1 zimbra-mta-patch -> 10.1.17.1777365774-1 zimbra-onlyoffice-patch -> 10.1.17.1777365774-1 zimbra-proxy-patch -> 10.1.17.1778988677-1 zimbra-ldap-patch -> 10.1.17.1777365774-1 zimbra-core-components -> 10.1.6-1zimbra10.0b1 zimbra-ldap-components -> 10.1.3-1zimbra10.0b1 zimbra-mta-components -> 10.1.5-1zimbra8.8b1 zimbra-lmdb -> 2.5.17-1zimbra10.0b2 zimbra-lmdb-lib -> 2.5.17-1zimbra10.0b2 zimbra-openldap-client -> 2.5.17-1zimbra10.0b2 zimbra-openldap-lib -> 2.5.17-1zimbra10.0b2 zimbra-openldap-server -> 2.5.17-1zimbra10.0b2 zimbra-postfix -> 3.6.14-1zimbra8.7b7 zimbra-zco -> 1951.1778166141-1 zimbra-license-daemon -> 1.0.0.1774413397-1 zimbra-common-mbox-conf-attrs -> 10.1.17.1777012766-1 zimbra-common-mbox-conf-msgs -> 10.1.17.1777362963-1 zimbra-common-core-jar -> 10.1.17.1777362963-1 zimbra-mbox-webclient-war -> 10.1.17.1776247073-1 zimbra-mbox-admin-console-war -> 10.1.17.1767695025-1 zimbra-mbox-ews-service -> 10.1.17.1778765350-1 zimbra-license-tools -> 10.1.17.1777004566-1 zimbra-onlyoffice -> 1.0.1771828636-1 zimbra-modern-ui -> 4.49.0.1777305880-1 zimbra-modern-zimlets -> 4.49.0.1777305880-1 zimbra-zimlet-admin-chat -> 2.1.3.1776773674-1 zimbra-zimlet-attachment-missing-alert -> 1.2.1.1776773674-1 zimbra-zimlet-chat -> 13.1.0.1776773674-1 zimbra-zimlet-classic-chat -> 3.1.0.1776773674-1 zimbra-zimlet-classic-set-default-client -> 1.5.1.1776773674-1 zimbra-zimlet-custom-fonts -> 2.3.0.1776773674-1 zimbra-zimlet-deceptive-link-detector -> 2.3.1.1776773674-1 zimbra-zimlet-desktop-auto-update -> 1.3.0.1776773674-1 zimbra-zimlet-disable-screen-capture -> 1.2.1.1776773674-1 zimbra-zimlet-download-email -> 2.4.0.1776773674-1 zimbra-zimlet-email-defanger -> 2.2.0.1776773674-1 zimbra-zimlet-email-reminder -> 1.3.0.1776773674-1 zimbra-zimlet-external-setting-links -> 1.3.1.1776773674-1 zimbra-zimlet-import-export-ics -> 2.4.0.1776773674-1 zimbra-zimlet-mail-translate -> 1.1.0.1776773674-1 zimbra-zimlet-modern-welcometour -> 6.5.0.1776773674-1 zimbra-zimlet-personal-notes -> 1.2.1.1776773674-1 zimbra-zimlet-preventive-ooo -> 2.2.1.1776773674-1 zimbra-zimlet-signature-template -> 1.3.0.1776773674-1 zimbra-zimlet-spy-blocker -> 2.3.0.1776773674-1 zimbra-zimlet-tlp -> 2.3.0.1776773674-1 zimbra-zimlet-voice-composer -> 1.3.0.1778059415-1 zimbra-zimlet-additional-signature-setting -> 10.0.1.1776773674-1 zimbra-zimlet-ads -> 9.5.0.1776773674-1 zimbra-zimlet-calendar-subscription -> 8.1.1.1776773674-1 zimbra-zimlet-classic-unsupportedbrowser -> 4.2.3.1776773674-1 zimbra-zimlet-date -> 10.2.1.1776773674-1 zimbra-zimlet-emptysubject -> 3.4.1.1776773674-1 zimbra-zimlet-install-pwa -> 7.5.0.1776773674-1 zimbra-zimlet-org-chart -> 5.1.0.1776773674-1 zimbra-zimlet-privacy-protector -> 6.2.1.1776773674-1 zimbra-zimlet-secure-mail -> 5.1.0.1776773674-1 zimbra-zimlet-set-default-client -> 11.4.0.1776773674-1 zimbra-zimlet-sideloader -> 10.0.1.1776773674-1 zimbra-zimlet-user-feedback -> 7.6.0.1776773674-1 zimbra-zimlet-user-sessions-management -> 11.0.1.1776773674-1 zimbra-zimlet-web-search -> 5.5.0.1776773674-1 zimbra-zimlet-classic-document-editor -> 2.4.3.1776773674-1 zimbra-zimlet-document-editor -> 14.1.0.1776773674-1
Patch Installation
Please refer to below link to install 10.1.17 (May 28 2026):
Quick note: Open Source repo
The steps to download, build, and see our code via Github can be found here:https://github.com/Zimbra/zm-build
Jump to: navigation,search