Vulnerability in Icewhaletech Zimaos
CVE-2026-28286
ZimaOS is a fork of CasaOS, an operating system for Zima devices and x86-64 systems with UEFI. In version 1.5.2-beta3, the application enforces restrictions in the frontend/UI to prevent users from creating files or folders in internal OS paths. However, when interacting directly with the API, the restrictions are bypass-able. By sending a crafted request targeting paths like /etc, /usr, or other sensitive system directories, the API successfully creates files or directories in locations where normal users should have no write access. This indicates that the API does not properly validate the target path, allowing unauthorized operations on critical system directories. No known patch is publicly available.
Published · last modified .
CVSS v3 metric
CVSS v3 base score 8.5 (High). Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H.
EPSS exploit prediction
EPSS: 0.006 (47.0th percentile), scored .
Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 47th percentile — 47.0% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.004 · newest: 0.006 · change: +0.002
Affected products
- Icewhaletech Zimaos — versions = 1.5.2-beta3
- Zimaspace Zimaos — versions 1.5.2
Weakness classification (CWE)
Public proof-of-concept exploits
References
- github.com/IceWhaleTech/ZimaOS/security/advisories/GHSA-65mg-9gw5-vr7g (Exploit, Mitigation, Vendor Advisory)
Frequently asked questions
- What is CVE-2026-28286?
- CVE-2026-28286 is a high-severity vulnerability in Icewhaletech Zimaos, classified under External Control of File Name or Path. CVSS score: 8.5/10. Published 2026-03-02.
- How severe is CVE-2026-28286?
- High severity. CVSS v3 base score is 8.5 out of 10.
- Is CVE-2026-28286 known to be exploited?
- 1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.