CVE-2026-28442

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-28442", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-02-27T15:54:05.140Z", "datePublished": "2026-03-05T20:38:37.475Z", "dateUpdated": "2026-03-06T16:32:31.628Z"}, "containers": {"cna": {"title": "ZimaOS: Arbitrary Deletion of Internal System Files via API Path Manipulation", "problemTypes": [{"descriptions": [{"cweId": "CWE-73", "lang": "en", "description": "CWE-73: External Control of File Name or Path", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.6, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H", "version": "3.1"}}], "references": [{"name": "https://github.com/IceWhaleTech/ZimaOS/security/advisories/GHSA-q5hp-59wm-9xq3", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/IceWhaleTech/ZimaOS/security/advisories/GHSA-q5hp-59wm-9xq3"}], "affected": [{"vendor": "IceWhaleTech", "product": "ZimaOS", "versions": [{"version": "= 1.5.2-beta3", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-03-05T20:38:37.475Z"}, "descriptions": [{"lang": "en", "value": "ZimaOS is a fork of CasaOS, an operating system for Zima devices and x86-64 systems with UEFI. In version 1.5.2-beta3, users are restricted from deleting internal system files or folders through the application interface. However, when interacting directly with the API, these restrictions can be bypassed. By altering the path parameter in the delete request, internal OS files and directories can be removed successfully. The backend processes these manipulated requests without validating whether the targeted path belongs to restricted system locations. This demonstrates improper input validation and broken access control on sensitive filesystem operations. No known public patch is available."}], "source": {"advisory": "GHSA-q5hp-59wm-9xq3", "discovery": "UNKNOWN"}}, "adp": [{"references": [{"url": "https://github.com/IceWhaleTech/ZimaOS/security/advisories/GHSA-q5hp-59wm-9xq3", "tags": ["exploit"]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-03-06T16:32:28.401334Z", "id": "CVE-2026-28442", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-06T16:32:31.628Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-28442", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-03-06T16:32:28.401334Z"}}}], "references": [{"url": "https://github.com/IceWhaleTech/ZimaOS/security/advisories/GHSA-q5hp-59wm-9xq3", "tags": ["exploit"]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-06T16:32:13.766Z"}}], "cna": {"title": "ZimaOS: Arbitrary Deletion of Internal System Files via API Path Manipulation", "source": {"advisory": "GHSA-q5hp-59wm-9xq3", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "CHANGED", "version": "3.1", "baseScore": 8.6, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}}], "affected": [{"vendor": "IceWhaleTech", "product": "ZimaOS", "versions": [{"status": "affected", "version": "= 1.5.2-beta3"}]}], "references": [{"url": "https://github.com/IceWhaleTech/ZimaOS/security/advisories/GHSA-q5hp-59wm-9xq3", "name": "https://github.com/IceWhaleTech/ZimaOS/security/advisories/GHSA-q5hp-59wm-9xq3", "tags": ["x_refsource_CONFIRM"]}], "descriptions": [{"lang": "en", "value": "ZimaOS is a fork of CasaOS, an operating system for Zima devices and x86-64 systems with UEFI. In version 1.5.2-beta3, users are restricted from deleting internal system files or folders through the application interface. However, when interacting directly with the API, these restrictions can be bypassed. By altering the path parameter in the delete request, internal OS files and directories can be removed successfully. The backend processes these manipulated requests without validating whether the targeted path belongs to restricted system locations. This demonstrates improper input validation and broken access control on sensitive filesystem operations. No known public patch is available."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-73", "description": "CWE-73: External Control of File Name or Path"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-03-05T20:38:37.475Z"}}}, "cveMetadata": {"cveId": "CVE-2026-28442", "state": "PUBLISHED", "dateUpdated": "2026-03-06T16:32:31.628Z", "dateReserved": "2026-02-27T15:54:05.140Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-03-05T20:38:37.475Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "ZimaOS", "vendor": "IceWhaleTech", "versions": [{"status": "affected", "version": "= 1.5.2-beta3"}]}], "source": "security-advisories@github.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:zimaspace:zimaos:1.5.2:beta3:*:*:*:*:*:*", "matchCriteriaId": "2DB5C60C-7888-4BE5-9FB2-AD34BFB45CAE", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "ZimaOS is a fork of CasaOS, an operating system for Zima devices and x86-64 systems with UEFI. In version 1.5.2-beta3, users are restricted from deleting internal system files or folders through the application interface. However, when interacting directly with the API, these restrictions can be bypassed. By altering the path parameter in the delete request, internal OS files and directories can be removed successfully. The backend processes these manipulated requests without validating whether the targeted path belongs to restricted system locations. This demonstrates improper input validation and broken access control on sensitive filesystem operations. No known public patch is available."}, {"lang": "es", "value": "ZimaOS es un fork de CasaOS, un sistema operativo para dispositivos Zima y sistemas x86-64 con UEFI. En la versi\u00f3n 1.5.2-beta3, los usuarios tienen restringido eliminar archivos o carpetas internos del sistema a trav\u00e9s de la interfaz de la aplicaci\u00f3n. Sin embargo, al interactuar directamente con la API, estas restricciones pueden ser eludidas. Al alterar el par\u00e1metro de ruta en la solicitud de eliminaci\u00f3n, los archivos y directorios internos del sistema operativo pueden ser eliminados con \u00e9xito. El backend procesa estas solicitudes manipuladas sin validar si la ruta objetivo pertenece a ubicaciones restringidas del sistema. Esto demuestra una validaci\u00f3n de entrada incorrecta y un control de acceso roto en operaciones sensibles del sistema de archivos. No hay ning\u00fan parche p\u00fablico conocido disponible."}], "id": "CVE-2026-28442", "lastModified": "2026-06-17T10:28:38.807", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.5, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 6.0, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-28442", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-03-06T16:32:28.401334Z", "version": "2.0.3"}}]}, "published": "2026-03-05T21:16:22.327", "references": [{"source": "security-advisories@github.com", "tags": ["Exploit", "Mitigation", "Vendor Advisory"], "url": "https://github.com/IceWhaleTech/ZimaOS/security/advisories/GHSA-q5hp-59wm-9xq3"}, {"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "tags": ["Exploit", "Mitigation", "Vendor Advisory"], "url": "https://github.com/IceWhaleTech/ZimaOS/security/advisories/GHSA-q5hp-59wm-9xq3"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-73"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "1.5.2-beta3"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "ZimaOS", "source": "cna", "vendor": "IceWhaleTech"}, "product": "zimaos", "vendor": "icewhaletech"}], "analysis": {"en": {"generated_at": "2026-04-18T09:52:30.422495+00:00", "value": {"mitigation_remediation": ["Require authentication and authorization checks for the delete API, ensuring only privileged users can remove files.", "Enforce strict path validation in the backend; reject delete requests whose targets fall outside a predefined safe directory scope.", "Apply OS\u2011level file permissions or access control lists (ACLs) to protect essential system directories from modification or deletion.", "Monitor API logs for unauthorized delete attempts and alert on suspicious activity."], "summary": {"action": "Monitor", "impact": "Unrestricted deletion of critical system files"}, "threat_synthesis": {"affected_systems": "The affected product is IceWhaleTech\u2019s ZimaOS, version\u202f1.5.2\u2011beta3. The operating system is a fork of CasaOS and is designed for Zima devices and general x86\u201164 systems with UEFI firmware. No other versions or products were listed as affected.", "description_and_impact": "ZimaOS, a fork of CasaOS, used on x86-64 UEFI devices, contains an API endpoint that deletes files or directories. In version 1.5.2\u2011beta3 the web interface prevents removal of internal system files, but the API does not validate the origin of the path supplied. By modifying the path parameter, an attacker can instruct the backend to delete any file or directory on the filesystem, including protected system locations. This weakness is a classic example of improper input validation (CWE\u201173) that results in the loss of essential files and the potential destruction of system functionality.", "risk_and_exploitability": "The vulnerability scores a CVSS score of 8.6, indicating high severity, yet the EPSS score is reported as less than 1\u202f%, suggesting a low current exploitation probability. The CVE is not listed in the CISA Known Exploited Vulnerabilities catalog. The likely attack vector is the remote API interface; attackers who can reach the deletion endpoint and craft a path parameter can trigger deletion of arbitrary files. The description does not explicitly state authentication requirements, so it is inferred that the API may be vulnerable to unauthenticated or malicious use. Given the high severity and the lack of a public patch, this vulnerability represents a critical risk if the API is exposed to attackers."}}}}, "created": "2026-03-06T15:00:58.731721+00:00", "updated": "2026-04-18T10:00:10.331537+00:00", "vendors": ["icewhaletech", "icewhaletech$PRODUCT$zimaos"]}