PT-2026-23517 · Casaos+1 · Casaos+1

Rushi9 · Publicado 2026-03-05 · Atualizado 2026-03-12 · CVE-2026-28442

Positive Technologies (AI Summary)

CVSS v3.1

8.5

Alta

Vetor base

AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions ZimaOS version 1.5.2-beta3

Description ZimaOS, a fork of CasaOS, exhibits a security issue where restrictions on deleting internal system files and folders can be bypassed through manipulation of the API. Specifically, altering the path parameter in a delete request allows users to remove sensitive operating system files and directories. The backend does not validate if the targeted path is within restricted system locations, indicating improper input validation and broken access control on filesystem operations. The API endpoint used for deletion accepts a path parameter that is not properly sanitized. The path parameter is vulnerable to manipulation.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Enumeração de Fraquezas

CWE-73

Identificadores relacionados

CVE-2026-28442

GHSA-Q5HP-59WM-9XQ3

Produtos afetados

Casaos

Zimaos

Referências · 9

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/28xxx/CVE-2026-28442.json · Exploit
• 🔥 https://github.com/IceWhaleTech/ZimaOS/security/advisories/GHSA-q5hp-59wm-9xq3 · Exploit
• https://twitter.com/CveFindCom/status/2029673737637785855 · Publicação no Twitter
• https://twitter.com/CVEnew/status/2030385209938428035 · Publicação no Twitter
• https://twitter.com/dailycve/status/2032096594741350549 · Publicação no Twitter
• https://nvd.nist.gov/vuln/detail/CVE-2026-28442 · Nota de Segurança
• https://t.me/cveNotify/155260 · Publicação no Telegram
• https://twitter.com/TheHackerWire/status/2030297359289372945 · Publicação no Twitter
• https://osv.dev/vulnerability/CVE-2026-28442 · Aviso do Fabricante