ZimaOS, a fork of CasaOS, used on x86-64 UEFI devices, contains an API endpoint that deletes files or directories. In version 1.5.2‑beta3 the web interface prevents removal of internal system files, but the API does not validate the origin of the path supplied. By modifying the path parameter, an attacker can instruct the backend to delete any file or directory on the filesystem, including protected system locations. This weakness is a classic example of improper input validation (CWE‑73) that results in the loss of essential files and the potential destruction of system functionality.

The affected product is IceWhaleTech’s ZimaOS, version 1.5.2‑beta3. The operating system is a fork of CasaOS and is designed for Zima devices and general x86‑64 systems with UEFI firmware. No other versions or products were listed as affected.

The vulnerability scores a CVSS score of 8.6, indicating high severity, yet the EPSS score is reported as less than 1 %, suggesting a low current exploitation probability. The CVE is not listed in the CISA Known Exploited Vulnerabilities catalog. The likely attack vector is the remote API interface; attackers who can reach the deletion endpoint and craft a path parameter can trigger deletion of arbitrary files. The description does not explicitly state authentication requirements, so it is inferred that the API may be vulnerable to unauthenticated or malicious use. Given the high severity and the lack of a public patch, this vulnerability represents a critical risk if the API is exposed to attackers.