Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
7.3

ZimaOS Privilege Escalation using localhost calls to File API Upload

CVE-2025-58432 · published 1 year ago
Summary

ZimaOS is a fork of CasaOS, an operating system for Zima devices and x86-64 systems with UEFI. In version 1.4.1 and all prior versions, the /v2_1/files/file/uploadV2 endpoint allows file upload from ANY USER who has access to localhost. File uploads are performed AS ROOT.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software
VendorProductAffected versions
zimaspace zimaos <= 1.4.1
cpe:2.3:o:zimaspace:zimaos:*:*:*:*:*:*:*:*
Original advisory text
ZimaOS Privilege Escalation using localhost calls to File API Upload
ZimaOS is a fork of CasaOS, an operating system for Zima devices and x86-64 systems with UEFI. In version 1.4.1 and all prior versions, the /v2_1/files/file/uploadV2 endpoint allows file upload from ANY USER who has access to localhost. File uploads are performed AS ROOT.
References
Fix within
Internet-facing 60 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit
  • Gives an attacker partial control
Severity
7.3 High
Exploitation
<1% chance of attack within 30 days
Type
CWE-250Execution with Unnecessary Privileges
CWE-269Improper Privilege Management
Timeline
Published17 Sep 2025
Updated3 Nov 2026
First seen29 Sep 2026
Sources
CVE-2025-58432 · NVD
CVE-2025-58432 · OSV
GHSA-3gp9-43rg-xrcc · GHSA
Track software like this
Free during beta