CVE-2026-28286

Status: AnalyzedCritical (9.9)—

ZimaOS is a fork of CasaOS, an operating system for Zima devices and x86-64 systems with UEFI. In version 1.5.2-beta3, the application enforces restrictions in the frontend/UI to prevent users from creating files or folders in internal OS paths. However, when interacting directly with the API, the restrictions are bypass-able. By sending a crafted request targeting paths like /etc, /usr, or other sensitive system directories, the API successfully creates files or directories in locations where normal users should have no write access. This indicates that the API does not properly validate the target path, allowing unauthorized operations on critical system directories. No known patch is publicly available.

CVSS

Version: 3.1
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Base score: 9.9

Exploitation probability (EPSS)

Probability of exploitation in the next 30 days: 0.61%
Percentile among all scored CVEs: 47
Score date: 10/5/2026

EPSS (Exploit Prediction Scoring System, FIRST) estimates how likely a vulnerability is to be exploited in the wild within 30 days. It complements CVSS (impact) and CISA KEV (confirmed exploitation).

🎯 ATT&CK techniques

How this vulnerability is exploited and what the attacker gains, in MITRE ATT&CK terms.

ExploitationT1210 Exploitation of Remote Serviceslateral movement75 %
Primary impactT1548.001 Setuid and Setgidprivilege escalation80 %
Secondary impactT1036.005 Match Legitimate Resource Name or Locationstealth65 %
Secondary impactT1565.001 Stored Data Manipulationimpact75 %

CWE-73 con AV:N, PR:L permite bypasser validaciones en API remota para escribir en directorios críticos (/etc, /usr), escalando privilegios, manipulando archivos de sistema y potencialmente desplegando persistencia.

Inferred by our analysis agent from the official description, CVSS vector and CWE, and checked by a supervisor. May contain errors.

🛡️ ATT&CK mitigations that cover these techniques

Restrict File and Directory Permissions Vulnerability Scanning Threat Intelligence Program Privileged Account Management Operating System Configuration Remote Data Storage

Affected technologies (1)

Zimaspace — Zimaos

CWEs

CWE-73

References

https://github.com/IceWhaleTech/ZimaOS/security/advisories/GHSA-65mg-9gw5-vr7g

Raw JSON (NVD)

Show

{
  "id": "CVE-2026-28286",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-28286",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2026-03-03T15:49:59.223184Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "security-advisories@github.com",
        "cvssData": {
          "scope": "CHANGED",
          "version": "3.1",
          "baseScore": 8.5,
          "attackVector": "NETWORK",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "HIGH",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 6,
        "exploitabilityScore": 1.8
      },
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "CHANGED",
          "version": "3.1",
          "baseScore": 9.9,
          "attackVector": "NETWORK",
          "baseSeverity": "CRITICAL",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 6,
        "exploitabilityScore": 3.1
      }
    ]
  },
  "affected": [
    {
      "source": "security-advisories@github.com",
      "affectedData": [
        {
          "vendor": "IceWhaleTech",
          "product": "ZimaOS",
          "versions": [
            {
              "status": "affected",
              "version": "= 1.5.2-beta3"
            }
          ]
        }
      ]
    }
  ],
  "published": "2026-03-02T17:16:33.610",
  "references": [
    {
      "url": "https://github.com/IceWhaleTech/ZimaOS/security/advisories/GHSA-65mg-9gw5-vr7g",
      "tags": [
        "Exploit",
        "Mitigation",
        "Vendor Advisory"
      ],
      "source": "security-advisories@github.com"
    }
  ],
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "security-advisories@github.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-73"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "ZimaOS is a fork of CasaOS, an operating system for Zima devices and x86-64 systems with UEFI. In version 1.5.2-beta3, the application enforces restrictions in the frontend/UI to prevent users from creating files or folders in internal OS paths. However, when interacting directly with the API, the restrictions are bypass-able. By sending a crafted request targeting paths like /etc, /usr, or other sensitive system directories, the API successfully creates files or directories in locations where normal users should have no write access. This indicates that the API does not properly validate the target path, allowing unauthorized operations on critical system directories. No known patch is publicly available."
    },
    {
      "lang": "es",
      "value": "ZimaOS es una bifurcación de CasaOS, un sistema operativo para dispositivos Zima y sistemas x86-64 con UEFI. En la versión 1.5.2-beta3, la aplicación impone restricciones en el frontend/UI para evitar que los usuarios creen archivos o carpetas en rutas internas del sistema operativo. Sin embargo, al interactuar directamente con la API, las restricciones son eludibles. Al enviar una solicitud manipulada dirigida a rutas como /etc, /usr u otros directorios sensibles del sistema, la API crea con éxito archivos o directorios en ubicaciones donde los usuarios normales no deberían tener acceso de escritura. Esto indica que la API no valida correctamente la ruta de destino, permitiendo operaciones no autorizadas en directorios críticos del sistema. No hay ningún parche conocido disponible públicamente."
    }
  ],
  "lastModified": "2026-06-17T10:28:25.847",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:zimaspace:zimaos:1.5.2:beta3:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "2DB5C60C-7888-4BE5-9FB2-AD34BFB45CAE"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "security-advisories@github.com"
}