IceWhaleTech ZimaOS 1.5.2-beta3 Frontend/UI file inclusion

Summaryinfo

A vulnerability was found in IceWhaleTech ZimaOS 1.5.2-beta3. It has been classified as critical. The affected element is an unknown function of the component Frontend/UI. This manipulation causes file inclusion. The identification of this vulnerability is CVE-2026-28286. It is possible to initiate the attack remotely. There is no exploit available.

Detailsinfo

A vulnerability classified as critical was found in IceWhaleTech ZimaOS 1.5.2-beta3. Affected by this vulnerability is an unknown code block of the component Frontend/UI. The manipulation with an unknown input leads to a file inclusion vulnerability. The CWE definition for the vulnerability is CWE-73. The product allows user input to control or influence paths or file names that are used in filesystem operations. As an impact it is known to affect confidentiality, integrity, and availability. The summary by CVE is:

ZimaOS is a fork of CasaOS, an operating system for Zima devices and x86-64 systems with UEFI. In version 1.5.2-beta3, the application enforces restrictions in the frontend/UI to prevent users from creating files or folders in internal OS paths. However, when interacting directly with the API, the restrictions are bypass-able. By sending a crafted request targeting paths like /etc, /usr, or other sensitive system directories, the API successfully creates files or directories in locations where normal users should have no write access. This indicates that the API does not properly validate the target path, allowing unauthorized operations on critical system directories. No known patch is publicly available.

The advisory is shared at github.com. This vulnerability is known as CVE-2026-28286 since 02/26/2026. The exploitation appears to be difficult. The attack can be launched remotely. Neither technical details nor an exploit are publicly available. The price for an exploit might be around USD $0-$5k at the moment (estimation calculated on 03/05/2026).

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

The vulnerability is also documented in the vulnerability database at EUVD (EUVD-2026-9206). Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Productinfo

Vendor

• IceWhaleTech

Name

• ZimaOS

Version

• 1.5.2-beta3

Website

• Product: https://github.com/IceWhaleTech/ZimaOS/

CPE 2.3info

• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Discussion