Rushi9

**Name of the Vulnerable Software and Affected Versions** ZimaOS version 1.5.2-beta3 **Description** ZimaOS, a fork of CasaOS, exhibits a security issue where restrictions on deleting internal system files and folders can be bypassed through manipulation of the API. Specifically, altering the path parameter in a delete request allows users to remove sensitive operating system files and directories. The backend does not validate if the targeted path is within restricted system locations, indicating improper input validation and broken access control on filesystem operations. The API endpoint used for deletion accepts a path parameter that is not properly sanitized. The `path` parameter is vulnerable to manipulation. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Name of the Vulnerable Software and Affected Versions ZimaOS version 1.5.2-beta3 Description ZimaOS is a fork of CasaOS, an operating system for Zima devices and x86-64 systems with UEFI. In version 1.5.2-beta3, the application restricts file and folder creation in internal OS paths through the user interface. However, these restrictions can be bypassed by directly interacting with the API. A crafted request targeting paths such as `/etc` or `/usr` allows the creation of files or directories in locations where normal users lack write access. This occurs because the API does not properly validate the target path, enabling unauthorized operations on critical system directories. The API endpoint is vulnerable to path traversal attacks. The vulnerable parameter is the target path provided in the API request. Recommendations Update ZimaOS to a newer version that contains a fix for this vulnerability. At the moment, there is no information about a newer version that contains a fix for this vulnerability.