PT-2026-23517 · Casaos+1 · Casaos+1

Rushi9 · Published 2026-03-05 · Updated 2026-03-12 · CVE-2026-28442

Positive Technologies (AI Summary)

CVSS v3.1

8.5

High

Base vector

AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions ZimaOS version 1.5.2-beta3

Description ZimaOS, a fork of CasaOS, exhibits a security issue where restrictions on deleting internal system files and folders can be bypassed through manipulation of the API. Specifically, altering the path parameter in a delete request allows users to remove sensitive operating system files and directories. The backend does not validate if the targeted path is within restricted system locations, indicating improper input validation and broken access control on filesystem operations. The API endpoint used for deletion accepts a path parameter that is not properly sanitized. The path parameter is vulnerable to manipulation.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Weakness Enumeration

CWE-73

Related Identifiers

CVE-2026-28442

GHSA-Q5HP-59WM-9XQ3

Affected Products

Casaos

Zimaos

References · 9

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/28xxx/CVE-2026-28442.json · Exploit
• 🔥 https://github.com/IceWhaleTech/ZimaOS/security/advisories/GHSA-q5hp-59wm-9xq3 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-28442 · Security Note
• https://osv.dev/vulnerability/CVE-2026-28442 · Vendor Advisory
• https://twitter.com/CveFindCom/status/2029673737637785855 · Twitter Post
• https://twitter.com/CVEnew/status/2030385209938428035 · Twitter Post
• https://twitter.com/dailycve/status/2032096594741350549 · Twitter Post
• https://t.me/cveNotify/155260 · Telegram Post
• https://twitter.com/TheHackerWire/status/2030297359289372945 · Twitter Post