Read the docs
TI-2026-22593 Aliases CVE-2026-28286

ZimaOS: Unauthorized Creation of Files/Folders in Restricted System Directories via API

Priority MEDIUM 43CWE-73Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
High · High · High
Fix status
No fix listed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA.

Summary

ZimaOS is a fork of CasaOS, an operating system for Zima devices and x86-64 systems with UEFI. In version 1.5.2-beta3, the application enforces restrictions in the frontend/UI to prevent users from creating files or folders in internal OS paths. However, when interacting directly with the API, the restrictions are bypass-able. By sending a crafted request targeting paths like /etc, /usr, or other sensitive system directories, the API successfully creates files or directories in locations where normal users should have no write access. This indicates that the API does not properly validate the target path, allowing unauthorized operations on critical system directories. No known patch is publicly available.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00467 40th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
IceWhaleTechZimaOS= 1.5.2-beta3—No fix listedCNA
  • ZimaOS VendorIceWhaleTech Affected = 1.5.2-beta3 Fixed in — No fix listed CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:o:zimaspace:zimaos:1.5.2:beta3:*:*:*:*:*:*1.5.2 beta3VulnerableZimaspace
  • cpe:2.3:o:zimaspace:zimaos:1.5.2:beta3:*:*:*:*:*:* Versions 1.5.2 beta3 Vulnerable ·Zimaspace

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-28286

References

Exploit 1

  • TI-2026-17591 ZimaOS has Authentication Bypass via System-Level Username CVSS 3.1CRITICAL 9.8
  • TI-2024-16284 CasaOS Improper Restriction of Excessive Authentication Attempts vulnerability CVSS 3.1CRITICAL 9.8
  • TI-2024-16282 CasaOS-UserService allows unauthorized access to any file CVSS 3.1CRITICAL 9.8
  • TI-2024-32947 ZimaOS vulnerable to Directory Listing via Parameter Manipulation CVSS 3.1HIGH 7.5
  • TI-2024-32626 ZimaOS Arbitrary File Read via Parameter Manipulation CVSS 3.1HIGH 7.5
  • TI-2023-19077 CasaOS Command Injection vulnerability CVSS 3.1HIGH 8.8
See all 20 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences