PT-2026-1178 · Casaos · Casaos

Mike G.A + 1 · Published 2026-01-02 · Updated 2026-02-26 · CVE-2025-34171

Positive Technologies (AI Summary)

CVSS v4.0

6.9

Medium

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions CasaOS versions up to and including 0.4.15

Description CasaOS versions up to and including 0.4.15 have unauthenticated endpoints that allow remote attackers to retrieve sensitive configuration files and system debug information. The /v1/users/image API endpoint can be abused with a user-controlled path parameter to access files under /var/lib/casaos/1/, revealing installed applications and configuration details. The /v1/sys/debug API endpoint discloses host operating system, kernel, hardware, and storage information. These endpoints also return distinct error messages, enabling file existence enumeration of arbitrary paths on the underlying host filesystem. This information disclosure can be used for reconnaissance and to facilitate targeted follow-up attacks. The user-controlled path parameter in the /v1/users/image endpoint is a key component of the issue.

Recommendations CasaOS versions prior to 0.4.15 should be used.

Fix

RCE

Missing Authorization

Weakness Enumeration

CWE-862

CWE-497

Related Identifiers

CVE-2025-34171

Affected Products

Casaos

References · 8

• https://osv.dev/vulnerability/CVE-2025-34171 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-34171 · Security Note
• https://github.com/IceWhaleTech/CasaOS · Note
• https://casaos.zimaspace.com · Note
• https://t.me/cveNotify/153379 · Telegram Post
• https://vulncheck.com/advisories/casaos-unauthenticated-file-and-debug-data-exposure · Note
• https://t.me/cveNotify/147643 · Telegram Post
• https://t.me/CVEtracker/41275 · Telegram Post