We have a new problem with Carbonio Release 26.3.2 (Network Edition AND Community, same problem)

It's currently impossible to insert an image with basic copy/past into an email signature.

The error is:
One or more signatures have exceeded the size limit.

I deleted all the signatures and created a new one, but the problem persists.

Any ideas ?

Just now I found again that mongooseim is puking into the logs every 15s:

May 01 09:02:48 <my hostname> mongooseimctl: =ERROR REPORT==== 1-May-2026::09:02:48.750635 ===
May 01 09:02:48 <my hostname> mongooseimctl:     reason: function_clause
May 01 09:02:48 <my hostname> mongooseimctl:     stacktrace: <<"wpool_pool:g/2:334 mongoose_wpool_rdbms:get_rdbms_data_stats/2:64 safely:apply_and_log/4:58 mongoose_instrument_probe:call/3:20">>
May 01 09:02:48 <my hostname> mongooseimctl:     class: error
May 01 09:02:48 <my hostname> mongooseimctl:     what: probe_failed
May 01 09:02:48 <my hostname> mongooseimctl:     event_name: wpool_global_rdbms_stats
May 01 09:02:48 <my hostname> mongooseimctl:     labels: #{pool_tag => default}
May 01 09:02:48 <my hostname> mongooseimctl:     probe_mod: mongoose_wpool_rdbms
May 01 09:02:48 <my hostname> mongooseimctl:     stacktrace_args: <<"">>

If possible, I would like to either remove all packages related to chat or at least make sure that anything that is only required for chat will never be started on boot.

Is that possible in a way that will survive updates?

Thanks, Christian

Recently we found out that some Javascript can be executed inside Carbonio web interface.

We had received mail with this code inside mail body

[Original report redacted — full proof-of-concept and reproduction steps shared privately at security@zextras.com for coordinated disclosure.

and two pop-ups with this text - Javascript from servername 1 - were shown when I just open this mail. I guess this looks like vulnerability.

Affected only Chrome-based browsers.

Steps to reproduce:

1. Receive the code above in separate email, or attach this code as EML file
2. Open email or attached EML file with this code
3. Javascript Pop-up shows up twice

What can we do to prevent this? Thank you

zmcontrol -v
Carbonio Release 26.3.1

Here is the problem description, in brief.

I am migrating from zimbra FOSS 8.8.15 to carbonio CE.  I appear to have hit some kind of connection limit on the new server that I long ago fixed on the zimbra server (although that is a conclusion drawn from the intensive searching I have been doing. I have no notes of the changes, but the fixes are changes to the zimbra defaults).  Specifically, we have approx 13 IMAP clients connecting to the same account on either server.  When we get to attempting to connect the 12th and 13th clients to the carbonio server, Betterbird (the IMAP client) takes about 90 seconds to timeout and report "unable to connect to .... If the problem persists you may have exceeded the maximum number of connections to this server" (I see no way to include a screenshot, except as a link, which will be useless in very short order).

Is there a command-line reference for the carbonio prov commands and options?  The 'carbonio help prov' command gives less-than-useful hints for this particular situation.  

In particular, is there a provisioning command for carbonio CE for thie ZimbraImapNumThreads and zimbraImapMaxConnections?  This is what I (must have) used for zimbra FOSS 8.8.15 ('cause the defaults recorded in various search hits from years ago for zimbra are both 200), since the current setting for both on the zimbra server is 500.

zmprov ms `zmhostname` zimbraImapNumThreads 500
zmprov ms `zmhostname` zimbraImapMaxConnections 500

This command, after a long wrestling match with claude and gemini, to get zextras to give up its secrets gives me a clue...

carbonio prov gs $(zmhostname) | grep -i imap
  zimbraImapMaxConnections: 200
  zimbraImapNumThreads: 200
  <much output elided>

The attributes exist! Now, how the bleep do I change them?

zextras@mail:~$ carbonio prov ms $(zmhostname) zimbraImapMaxConnections 500
zextras@mail:~$ carbonio prov ms $(zmhostname) zimbraImapNumThreads 500
carbonio prov gs $(zmhostname) | grep -i zimbraImap
  zimbraImapMaxConnections: 500
  zimbraImapNumThreads: 500

now all I need to do is wait for the bulk email migration to complete so I can restart and see if it truly does have an effect

Would dearly love to find a community discussion of how to do things in CE by people who have done it.

I have a basically unconfigured carbonio server - the password for zextras has been changed, and I've added a test user (to determine where I need to provision storage for the the mail I will be migrating here).  In the rehersals/testing, e.g. shutting down all the carbonio services cleanly  I have discovered that after some amount of idle time and/or light testing (sending email between two on-host users) that service units (not sure of the correct jargon) have failed:

Get the list of all Carbonio services

systemctl list-unit-files

systemctl status
● mail.domain.com
   State: degraded
● mail.doamin.com
   State: degraded
   Units: 556 loaded (incl. loaded aliases)
    Jobs: 0 queued
  Failed: 2 units
   Since: Tue 2026-04-21 23:19:36 PDT; 1 day 15h ago
 systemd: 255.4-1ubuntu8.15

so - what has failed?

~# systemctl list-units --failed
   UNIT                             LOAD   ACTIVE SUB    DESCRIPTION                   
   ● carbonio-docs-editor.service     loaded failed failed Carbonio Docs Server
   ● carbonio-preview-sidecar.service loaded failed failed Carbonio Preview sidecar proxy
 
   Legend: LOAD   → Reflects whether the unit definition was properly loaded.
           ACTIVE → The high-level unit activation state, i.e. generalization of SUB.
           SUB    → The low-level unit activation state, values depend on unit type.
  
  2 loaded units listed.

anybody with any knowledge about what this means  for ongoing operations, and what, if anything I can do about it -- please weigh in.

root@mail1:/opt/zextras# systemctl stop carbonio.target
root@mail1:/opt/zextras# systemctl status carbonio.target
○ carbonio.target - Zextras Carbonio
Loaded: loaded ( removed link ; enabled; preset: enabled)
Active: inactive (dead) since Tue 2026-04-21 18:25:34 PDT; 11s ago
Docs: man:systemd.special(7)

Apr 20 18:13:50 mail1.kibro.com systemd: Reached target carbonio.target - Zextras Carbonio.
Apr 21 18:25:34 mail1.kibro.com systemd: Stopped target carbonio.target - Zextras Carbonio.

top - 18:40:10 up 1 day, 27 min, 1 user, load average: 0.02, 0.11, 0.45
Tasks: 294 total, 1 running, 292 sleeping, 0 stopped, 1 zombie

here is what I am talking about...
as an aside, the whole carbonio mesh thing seems to generate 26-29 zombie
processes at cold boot...

root@mail1:/opt/zextras# ps aux | awk '$8 ~ /^/'
carboni+ 3733 0.0 0.0 0 0 ? Z Apr20 0:00  <defunct>
root@mail1:/opt/zextras# ps -o ppid= -p 3733
3200
root@mail1:/opt/zextras# ps aux | grep 3200 | grep -v root
carboni+ 3200 0.7 0.0 2398496 62096 ? Ssl Apr20 10:51 /usr/bin/envoy --config-path  removed link  --disable-hot-restart

Unfortunately, clicking on the little magnifying glass has no effect, and I'm guessing that is its intended function, since there is no mouse-over to actually describe it.  This is true with Firefox and Chrome, on both Linux and windows

So, is it your site, or is it me?