CVE-2024-48931

ZimaOS is a fork of CasaOS, an operating system for Zima devices and x86-64 systems with UEFI. In version 1.2.4 and all prior versions, the ZimaOS API endpoint `http://<Zima_Server_IP:PORT>/v3/file?token=<token>&files=<file_path>` is vulnerable to arbitrary file reading due to improper input validation. By manipulating the `files` parameter, authenticated users can read sensitive system files, including `/etc/shadow`, which contains password hashes for all users. This vulnerability exposes critical system data and poses a high risk for privilege escalation or system compromise. The vulnerability occurs because the API endpoint does not validate or restrict file paths provided via the `files` parameter. An attacker can exploit this by manipulating the file path to access sensitive files outside the intended directory. As of time of publication, no known patched versions are available.

• CWE-22
• CWE-22

• https://github.com/IceWhaleTech/ZimaOS/security/advisories/GHSA-hjw2-9gq5-qgwjExploit, Vendor Advisory
• https://youtu.be/FyIfcmCyDXsExploit

Published

Oct 24, 2024

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2024-48926Umbraco, a free and open source .NET content management syst…3.1
• CVE-2024-48927Umbraco, a free and open source .NET content management syst…4.6
• CVE-2024-48928Piwigo is an open source photo gallery application for the w…7.5
• CVE-2024-48929Umbraco is a free and open source .NET content management sy…4.2
• CVE-2024-4893DigiWin EasyFlow .NET lacks validation for certain input par…9.8
• CVE-2024-48930secp256k1-node is a Node.js binding for an Optimized C libra…8.7
• CVE-2024-48932ZimaOS is a fork of CasaOS, an operating system for Zima dev…5.3
• CVE-2024-48933A cross-site scripting (XSS) vulnerability in LemonLDAP::NG …6.1
• CVE-2024-48936SchedMD Slurm before 24.05.4 has Incorrect Authorization. A …5
• CVE-2024-48937Znuny before LTS 6.5.1 through 6.5.10 and 7.0.1 through 7.0.…6.1
• CVE-2024-48938Znuny before LTS 6.5.1 through 6.5.10 and 7.0.1 through 7.0.…7.5
• CVE-2024-48939Insufficient validation performed on the REST API License fi…7.5