CVE-2026-28442 Details
Description
ZimaOS is a fork of CasaOS, an operating system for Zima devices and x86-64 systems with UEFI. In version 1.5.2-beta3, users are restricted from deleting internal system files or folders through the application interface. However, when interacting directly with the API, these restrictions can be bypassed. By altering the path parameter in the delete request, internal OS files and directories can be removed successfully. The backend processes these manipulated requests without validating whether the targeted path belongs to restricted system locations. This demonstrates improper input validation and broken access control on sensitive filesystem operations. No known public patch is available.
A vulnerability in ZimaOS version 1.5.2-beta3 allows users to bypass restrictions on deleting internal system files and directories. While the application interface prevents such deletions, the API does not enforce the same limitations. By manipulating the path parameter in delete requests, it is possible to remove critical OS files and folders. This issue arises from inadequate input validation and flawed access control regarding sensitive filesystem operations.
To address this vulnerability, ZimaOS should implement strict server-side validation for all delete operations, allowing deletion only from predefined safe directories. Additionally, the system should reject any paths referencing critical system directories and consider applying filesystem sandboxing or chroot jail mechanisms. It is also crucial to ensure that backend access control is not solely reliant on frontend restrictions.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Mar 6, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/IceWhaleTech/ZimaOS/security/advisories/GHSA-q5hp-59wm-9xq3 | CISA-ADP | ExploitMitigationVendor Advisory |
| https://github.com/IceWhaleTech/ZimaOS/security/advisories/GHSA-q5hp-59wm-9xq3 | [email protected] | ExploitMitigationVendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-73 | External Control of File Name or Path | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| zimaspace zimaos | 1.5.2 beta3 |
CPE
Remediation
| |
Change History
5 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Mar 12, 2026 | Initial Analysis | [email protected] |
| Mar 6, 2026 | CVE Modified | CISA-ADP |
| Mar 5, 2026 | New CVE Received | [email protected] |