ZimaOS is a fork of CasaOS, an operating system for Zima devices and x86-64 systems with UEFI. In version 1.2.4 and all prior versions, the API endpoint `http://<Zima_Server_IP:PORT>/v2_1/file` in ZimaOS is vulnerable to a directory traversal attack, allowing authenticated users to list the contents of any directory on the server. By manipulating the path parameter, attackers can access sensitive system directories such as `/etc`, potentially exposing critical configuration files and increasing the risk of further attacks. As of time of publication, no known patched versions are available.
Fixes

Solution

No solution given by the vendor.


Workaround

No workaround given by the vendor.

History

Mon, 22 Sep 2025 16:45:00 +0000

Type Values Removed Values Added
CPEs cpe:2.3:a:zimaspace:zimaos:*:*:*:*:*:*:*:* cpe:2.3:o:zimaspace:zimaos:*:*:*:*:*:*:*:*

Wed, 06 Nov 2024 15:45:00 +0000

Type Values Removed Values Added
First Time appeared Zimaspace
Zimaspace zimaos
Weaknesses CWE-22
CPEs cpe:2.3:a:zimaspace:zimaos:*:*:*:*:*:*:*:*
Vendors & Products Zimaspace
Zimaspace zimaos

Fri, 25 Oct 2024 18:15:00 +0000

Type Values Removed Values Added
First Time appeared Icewhaletech
Icewhaletech zimaos
CPEs cpe:2.3:o:icewhaletech:zimaos:*:*:*:*:*:*:*:*
Vendors & Products Icewhaletech
Icewhaletech zimaos
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'poc', 'Technical Impact': 'total'}, 'version': '2.0.3'}


Thu, 24 Oct 2024 21:45:00 +0000

Type Values Removed Values Added
Description ZimaOS is a fork of CasaOS, an operating system for Zima devices and x86-64 systems with UEFI. In version 1.2.4 and all prior versions, the API endpoint `http://<Zima_Server_IP:PORT>/v2_1/file` in ZimaOS is vulnerable to a directory traversal attack, allowing authenticated users to list the contents of any directory on the server. By manipulating the path parameter, attackers can access sensitive system directories such as `/etc`, potentially exposing critical configuration files and increasing the risk of further attacks. As of time of publication, no known patched versions are available.
Title ZimaOS vulnerable to Directory Listing via Parameter Manipulation
Weaknesses CWE-552
References
Metrics cvssV3_1

{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N'}


cve-icon MITRE

Status: PUBLISHED

Assigner: GitHub_M

Published:

Updated: 2024-10-25T17:27:38.317Z

Reserved: 2024-10-14T13:56:34.809Z

Link: CVE-2024-49359

cve-icon Vulnrichment

Updated: 2024-10-25T17:27:32.954Z

cve-icon NVD

Status : Analyzed

Published: 2024-10-24T22:15:04.287

Modified: 2025-09-22T14:21:53.893

Link: CVE-2024-49359

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

No data.