CVE-2026-28286

ZimaOS: Unauthorized Creation of Files/Folders in Restricted System Directories via API

Published Mar 2, 2026 CVSS 3.1 · 8.6 High EPSS < 1% KEV · Not listed

Description

ZimaOS is a fork of CasaOS, an operating system for Zima devices and x86-64 systems with UEFI. In version 1.5.2-beta3, the application enforces restrictions in the frontend/UI to prevent users from creating files or folders in internal OS paths. However, when interacting directly with the API, the restrictions are bypass-able. By sending a crafted request targeting paths like /etc, /usr, or other sensitive system directories, the API successfully creates files or directories in locations where normal users should have no write access. This indicates that the API does not properly validate the target path, allowing unauthorized operations on critical system directories. No known patch is publicly available.

Analysis

Technical impact

An API endpoint in ZimaOS does not properly validate the target file path. By crafting a request with a path such as /etc or /usr, the API can create files or directories in system locations that normal users should not have write access to. This flaw allows an attacker to add or modify system files through the API, potentially disrupting configuration or creating a foothold for further exploitation.

Affected Systems

The vulnerability exists in IceWhaleTech ZimaOS version 1.5.2‑beta3. No other versions or related products are listed in the advisory.

Risk and Exploitability

The defect is rated high with a CVSS score of 8.6, while the EPSS probability is below 1% and it is not listed in the CISA KEV catalog. Exploitation requires only that an attacker can reach the vulnerable API endpoint; the path‑validation bypass enables file operations regardless of the caller’s privileges. The risk is elevated for installations that expose the API to untrusted networks or users who can send bespoke requests.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

IceWhaleTech

ZimaOS

affected

Version	Status	Constraints
`= 1.5.2-beta3`	affected	—

Configuration 1 [-]

cpe:2.3:o:zimaspace:zimaos:1.5.2:beta3:*:*:*:*:*:*

No data.

Vendor Product Versions

Icewhaletech

Zimaos

Version	Status	Scheme	Platform
`1.5.2-beta3`	affected	semver	—

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Restrict the API endpoint that creates files or directories to privileged users or disable it for non‑admin accounts.
Add server‑side validation to reject any path that resolves outside the intended application directories; disallow absolute paths or sequences that traverse upward.
Limit connectivity to the ZimaOS API by placing it behind a firewall or in a segregated subnet, permitting access only from trusted hosts.

Generated by OpenCVE AI on April 17, 2026 at 13:33 UTC.

Tracking

Advisories

No advisories available

Metrics

No CVSS v4.0

Attack Vector Network

Attack Complexity High

Privileges Required Low

Scope Changed

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.467% probability within 30 days)

Exploitation none

Automatable no

Technical Impact total

References

Link	Providers
https://github.com/IceWhaleTech/ZimaOS/security/advisories/GHSA-65mg-9gw5-vr7g

History

Mar 5, 2026 3:30 PM First appearance in the feed. Affected versions updated. Affected vendors updated View changes

Type	Values Removed	Values Added
First Time appeared		Zimaspace Zimaspace zimaos
CPEs		cpe:2.3:o:zimaspace:zimaos:1.5.2:beta3::::::
Vendors & Products		Zimaspace Zimaspace zimaos

Mar 4, 2026 11:00 AM First appearance in the feed. Affected vendors updated View changes

Type	Values Removed	Values Added
First Time appeared		Icewhaletech Icewhaletech zimaos
Vendors & Products		Icewhaletech Icewhaletech zimaos

Mar 3, 2026 4:15 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}`

Mar 2, 2026 4:45 PM Description updated. Title updated. Weaknesses updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Description		ZimaOS is a fork of CasaOS, an operating system for Zima devices and x86-64 systems with UEFI. In version 1.5.2-beta3, the application enforces restrictions in the frontend/UI to prevent users from creating files or folders in internal OS paths. However, when interacting directly with the API, the restrictions are bypass-able. By sending a crafted request targeting paths like /etc, /usr, or other sensitive system directories, the API successfully creates files or directories in locations where normal users should have no write access. This indicates that the API does not properly validate the target path, allowing unauthorized operations on critical system directories. No known patch is publicly available.
Title		ZimaOS: Unauthorized Creation of Files/Folders in Restricted System Directories via API
Weaknesses		CWE-73
References		https://github.com/IceWhaleTech/ZimaOS/security/advisories/GHSA-65mg-9gw5-vr7g
Metrics		cvssV3_1 `{'score': 8.6, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H'}`