IceWhaleTech ZimaOS 1.5.2-beta3 Application Interface path file inclusion

Summaryinfo

A vulnerability identified as critical has been detected in IceWhaleTech ZimaOS 1.5.2-beta3. This impacts an unknown function of the component Application Interface. Performing a manipulation of the argument path results in file inclusion. This vulnerability is identified as CVE-2026-28442. The attack can be initiated remotely. There is not any exploit available.

Detailsinfo

A vulnerability classified as critical has been found in IceWhaleTech ZimaOS 1.5.2-beta3. This affects some unknown functionality of the component Application Interface. The manipulation of the argument path with an unknown input leads to a file inclusion vulnerability. CWE is classifying the issue as CWE-73. The product allows user input to control or influence paths or file names that are used in filesystem operations. This is going to have an impact on confidentiality, integrity, and availability. The summary by CVE is:

ZimaOS is a fork of CasaOS, an operating system for Zima devices and x86-64 systems with UEFI. In version 1.5.2-beta3, users are restricted from deleting internal system files or folders through the application interface. However, when interacting directly with the API, these restrictions can be bypassed. By altering the path parameter in the delete request, internal OS files and directories can be removed successfully. The backend processes these manipulated requests without validating whether the targeted path belongs to restricted system locations. This demonstrates improper input validation and broken access control on sensitive filesystem operations. No known public patch is available.

The advisory is shared at github.com. This vulnerability is uniquely identified as CVE-2026-28442 since 02/27/2026. The exploitability is told to be difficult. It is possible to initiate the attack remotely. Technical details are known, but no exploit is available. The price for an exploit might be around USD $0-$5k at the moment (estimation calculated on 03/10/2026).

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Productinfo

Vendor

• IceWhaleTech

Name

• ZimaOS

Version

• 1.5.2-beta3

Website

• Product: https://github.com/IceWhaleTech/ZimaOS/

CPE 2.3info

• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Discussion