PT-2026-22627 · Casaos+1 · Casaos+1

Published 2026-03-02 · Updated 2026-03-06 · CVE-2025-64427

Positive Technologies (AI Summary)

CVSS v3.1

7.1

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:L

Name of the Vulnerable Software and Affected Versions ZimaOS versions prior to 1.5.1

Description ZimaOS, a fork of CasaOS, is susceptible to a flaw stemming from inadequate validation or restriction of target URLs. An authenticated local user can construct requests that target internal IP addresses, such as 127.0.0.1, localhost, or private network ranges. This enables interaction with internal HTTP/HTTPS services not intended for external or local user access.

Recommendations Update ZimaOS to version 1.5.1 or later. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Information Disclosure

SSRF

Weakness Enumeration

CWE-200

CWE-918

Related Identifiers

CVE-2025-64427

GHSA-M8HJ-7XG5-P375

Affected Products

Casaos

Zimaos

References · 10

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/64xxx/CVE-2025-64427.json · Exploit
• https://github.com/IceWhaleTech/ZimaOS/security/advisories/GHSA-m8hj-7xg5-p375 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-64427 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-64427 · Security Note
• https://twitter.com/VulmonFeeds/status/2028650273300758899 · Twitter Post
• https://t.me/cveNotify/154338 · Telegram Post
• https://t.me/CVEtracker/46128 · Telegram Post
• https://twitter.com/cracbot/status/2029512417160658985 · Twitter Post
• https://twitter.com/cracbot/status/2029874879013806348 · Twitter Post
• https://twitter.com/CVEnew/status/2028523508188242121 · Twitter Post