CVE-2026-28286

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-28286", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-02-26T01:52:58.735Z", "datePublished": "2026-03-02T16:28:39.365Z", "dateUpdated": "2026-03-03T15:51:04.880Z"}, "containers": {"cna": {"title": "ZimaOS: Unauthorized Creation of Files/Folders in Restricted System Directories via API", "problemTypes": [{"descriptions": [{"cweId": "CWE-73", "lang": "en", "description": "CWE-73: External Control of File Name or Path", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.6, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H", "version": "3.1"}}], "references": [{"name": "https://github.com/IceWhaleTech/ZimaOS/security/advisories/GHSA-65mg-9gw5-vr7g", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/IceWhaleTech/ZimaOS/security/advisories/GHSA-65mg-9gw5-vr7g"}], "affected": [{"vendor": "IceWhaleTech", "product": "ZimaOS", "versions": [{"version": "= 1.5.2-beta3", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-03-02T16:28:39.365Z"}, "descriptions": [{"lang": "en", "value": "ZimaOS is a fork of CasaOS, an operating system for Zima devices and x86-64 systems with UEFI. In version 1.5.2-beta3, the application enforces restrictions in the frontend/UI to prevent users from creating files or folders in internal OS paths. However, when interacting directly with the API, the restrictions are bypass-able. By sending a crafted request targeting paths like /etc, /usr, or other sensitive system directories, the API successfully creates files or directories in locations where normal users should have no write access. This indicates that the API does not properly validate the target path, allowing unauthorized operations on critical system directories. No known patch is publicly available."}], "source": {"advisory": "GHSA-65mg-9gw5-vr7g", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-03-03T15:49:59.223184Z", "id": "CVE-2026-28286", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-03T15:51:04.880Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-28286", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-03-03T15:49:59.223184Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-03T15:50:58.842Z"}}], "cna": {"title": "ZimaOS: Unauthorized Creation of Files/Folders in Restricted System Directories via API", "source": {"advisory": "GHSA-65mg-9gw5-vr7g", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "CHANGED", "version": "3.1", "baseScore": 8.6, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}}], "affected": [{"vendor": "IceWhaleTech", "product": "ZimaOS", "versions": [{"status": "affected", "version": "= 1.5.2-beta3"}]}], "references": [{"url": "https://github.com/IceWhaleTech/ZimaOS/security/advisories/GHSA-65mg-9gw5-vr7g", "name": "https://github.com/IceWhaleTech/ZimaOS/security/advisories/GHSA-65mg-9gw5-vr7g", "tags": ["x_refsource_CONFIRM"]}], "descriptions": [{"lang": "en", "value": "ZimaOS is a fork of CasaOS, an operating system for Zima devices and x86-64 systems with UEFI. In version 1.5.2-beta3, the application enforces restrictions in the frontend/UI to prevent users from creating files or folders in internal OS paths. However, when interacting directly with the API, the restrictions are bypass-able. By sending a crafted request targeting paths like /etc, /usr, or other sensitive system directories, the API successfully creates files or directories in locations where normal users should have no write access. This indicates that the API does not properly validate the target path, allowing unauthorized operations on critical system directories. No known patch is publicly available."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-73", "description": "CWE-73: External Control of File Name or Path"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-03-02T16:28:39.365Z"}}}, "cveMetadata": {"cveId": "CVE-2026-28286", "state": "PUBLISHED", "dateUpdated": "2026-03-03T15:51:04.880Z", "dateReserved": "2026-02-26T01:52:58.735Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-03-02T16:28:39.365Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "ZimaOS", "vendor": "IceWhaleTech", "versions": [{"status": "affected", "version": "= 1.5.2-beta3"}]}], "source": "security-advisories@github.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:zimaspace:zimaos:1.5.2:beta3:*:*:*:*:*:*", "matchCriteriaId": "2DB5C60C-7888-4BE5-9FB2-AD34BFB45CAE", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "ZimaOS is a fork of CasaOS, an operating system for Zima devices and x86-64 systems with UEFI. In version 1.5.2-beta3, the application enforces restrictions in the frontend/UI to prevent users from creating files or folders in internal OS paths. However, when interacting directly with the API, the restrictions are bypass-able. By sending a crafted request targeting paths like /etc, /usr, or other sensitive system directories, the API successfully creates files or directories in locations where normal users should have no write access. This indicates that the API does not properly validate the target path, allowing unauthorized operations on critical system directories. No known patch is publicly available."}, {"lang": "es", "value": "ZimaOS es una bifurcaci\u00f3n de CasaOS, un sistema operativo para dispositivos Zima y sistemas x86-64 con UEFI. En la versi\u00f3n 1.5.2-beta3, la aplicaci\u00f3n impone restricciones en el frontend/UI para evitar que los usuarios creen archivos o carpetas en rutas internas del sistema operativo. Sin embargo, al interactuar directamente con la API, las restricciones son eludibles. Al enviar una solicitud manipulada dirigida a rutas como /etc, /usr u otros directorios sensibles del sistema, la API crea con \u00e9xito archivos o directorios en ubicaciones donde los usuarios normales no deber\u00edan tener acceso de escritura. Esto indica que la API no valida correctamente la ruta de destino, permitiendo operaciones no autorizadas en directorios cr\u00edticos del sistema. No hay ning\u00fan parche conocido disponible p\u00fablicamente."}], "id": "CVE-2026-28286", "lastModified": "2026-06-17T10:28:25.847", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.5, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 6.0, "source": "security-advisories@github.com", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.9, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 3.1, "impactScore": 6.0, "source": "nvd@nist.gov", "type": "Primary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-28286", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-03-03T15:49:59.223184Z", "version": "2.0.3"}}]}, "published": "2026-03-02T17:16:33.610", "references": [{"source": "security-advisories@github.com", "tags": ["Exploit", "Mitigation", "Vendor Advisory"], "url": "https://github.com/IceWhaleTech/ZimaOS/security/advisories/GHSA-65mg-9gw5-vr7g"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-73"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "1.5.2-beta3"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "ZimaOS", "source": "cna", "vendor": "IceWhaleTech"}, "product": "zimaos", "vendor": "icewhaletech"}], "analysis": {"en": {"generated_at": "2026-04-17T13:33:10.072570+00:00", "value": {"mitigation_remediation": ["Restrict the API endpoint that creates files or directories to privileged users or disable it for non\u2011admin accounts.", "Add server\u2011side validation to reject any path that resolves outside the intended application directories; disallow absolute paths or sequences that traverse upward.", "Limit connectivity to the ZimaOS API by placing it behind a firewall or in a segregated subnet, permitting access only from trusted hosts."], "summary": {"action": "Assess Impact", "impact": "Unauthorized File Creation"}, "threat_synthesis": {"affected_systems": "The vulnerability exists in IceWhaleTech ZimaOS version 1.5.2\u2011beta3. No other versions or related products are listed in the advisory.", "description_and_impact": "An API endpoint in ZimaOS does not properly validate the target file path. By crafting a request with a path such as /etc or /usr, the API can create files or directories in system locations that normal users should not have write access to. This flaw allows an attacker to add or modify system files through the API, potentially disrupting configuration or creating a foothold for further exploitation.", "risk_and_exploitability": "The defect is rated high with a CVSS score of 8.6, while the EPSS probability is below 1% and it is not listed in the CISA KEV catalog. Exploitation requires only that an attacker can reach the vulnerable API endpoint; the path\u2011validation bypass enables file operations regardless of the caller\u2019s privileges. The risk is elevated for installations that expose the API to untrusted networks or users who can send bespoke requests."}}}}, "created": "2026-03-03T08:42:38.969065+00:00", "updated": "2026-04-17T13:45:16.018995+00:00", "vendors": ["icewhaletech", "icewhaletech$PRODUCT$zimaos"]}