ZimaOS vulnerabilities

8 known vulnerabilities in ZimaOS from IceWhaleTech. 8 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 10.0 Critical severity

  ZimaOS: Server-Side Request Forgery

  CVE-2026-28798Apr 3, 2026IceWhaleTech

  ZimaOS is a fork of CasaOS, an operating system for Zima devices and x86-64 systems with UEFI. Prior to version 1.5.3, a proxy endpoint (/v1/sys/proxy) exposed by ZimaOS's web interface can be abused (via an externally reachable domain using a Cloudflare Tunne

• 8.5 High severity

  ZimaOS: External Control of File Name or Path

  CVE-2026-28442Mar 5, 2026IceWhaleTech

  ZimaOS is a fork of CasaOS, an operating system for Zima devices and x86-64 systems with UEFI. In version 1.5.2-beta3, users are restricted from deleting internal system files or folders through the application interface. However, when interacting directly wit

• 9.9 Critical severity

  ZimaOS: External Control of File Name or Path

  CVE-2026-28286Mar 2, 2026IceWhaleTech

  ZimaOS is a fork of CasaOS, an operating system for Zima devices and x86-64 systems with UEFI. In version 1.5.2-beta3, the application enforces restrictions in the frontend/UI to prevent users from creating files or folders in internal OS paths. However, when

• 9.8 Critical severity

  ZimaOS: Improper Authentication

  CVE-2026-21891Jan 8, 2026IceWhaleTechEPSS 2.32%

  ZimaOS is a fork of CasaOS, an operating system for Zima devices and x86-64 systems with UEFI. In versions up to and including 1.5.0, the application checks the validity of the username but appears to skip, misinterpret, or incorrectly validate the password wh

• 7.8 High severity

  ZimaOS: Execution with Unnecessary Privileges

  CVE-2025-58432Sep 17, 2025IceWhaleTech

  ZimaOS is a fork of CasaOS, an operating system for Zima devices and x86-64 systems with UEFI. In version 1.4.1 and all prior versions, the /v2_1/files/file/uploadV2 endpoint allows file upload from ANY USER who has access to localhost. File uploads are perfor

• 7.5 High severity

  ZimaOS: Improper Limitation of a Pathname to a Restricted Directory

  CVE-2024-49359Oct 24, 2024IceWhaleTech

  ZimaOS is a fork of CasaOS, an operating system for Zima devices and x86-64 systems with UEFI. In version 1.2.4 and all prior versions, the API endpoint `http://<Zima_Server_IP:PORT>/v2_1/file` in ZimaOS is vulnerable to a directory traversal attack, allowing

• 7.5 High severity

  ZimaOS: Missing Authorization

  CVE-2024-49357Oct 24, 2024IceWhaleTechEPSS 23.7%

  ZimaOS is a fork of CasaOS, an operating system for Zima devices and x86-64 systems with UEFI. In version 1.2.4 and all prior versions, the API endpoints in ZimaOS, such as `http://<Server-IP>/v1/users/image?path=/var/lib/casaos/1/app_order.json` and `http://<

• 7.5 High severity

  ZimaOS: Improper Limitation of a Pathname to a Restricted Directory

  CVE-2024-48931Oct 24, 2024IceWhaleTech

  ZimaOS is a fork of CasaOS, an operating system for Zima devices and x86-64 systems with UEFI. In version 1.2.4 and all prior versions, the ZimaOS API endpoint `http://<Zima_Server_IP:PORT>/v3/file?token=<token>&files=<file_path>` is vulnerable to arbitrary fi