CVE-2025-58431

ZimaOS is a fork of CasaOS, an operating system for Zima devices and x86-64 systems with UEFI. In version 1.4.1 and earlier, the /v2_1/files/file/download endpoint allows file read from ANY USER who has access to localhost. File reads are performed AS ROOT.

• CWE-250

• https://github.com/IceWhaleTech/ZimaOS/security/advisories/GHSA-vqrw-9v9m-6g87Exploit, Third Party Advisory
• https://github.com/IceWhaleTech/ZimaOS/security/advisories/GHSA-vqrw-9v9m-6g87Exploit, Third Party Advisory

Published

Sep 17, 2025

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-58426desknet's NEO V4.0R1.0 to V9.0R2.0 contains a hard-coded cry…5.3
• CVE-2025-58427An out-of-bounds read vulnerability exists in the EMF functi…7.1
• CVE-2025-58428The TLS4B ATG system's SOAP-based interface is vulnerable du…9.9
• CVE-2025-58429A relative path traversal vulnerability was discovered in Pr…8.3
• CVE-2025-5843The Brandfolder plugin for WordPress is vulnerable to Stored…6.4
• CVE-2025-58430listmonk is a standalone, self-hosted, newsletter and mailin…6.1
• CVE-2025-58432ZimaOS is a fork of CasaOS, an operating system for Zima dev…7.8
• CVE-2025-58434Flowise is a drag & drop user interface to build a customize…9.8
• CVE-2025-58435Open OnDemand is an open-source HPC portal. Prior to version…4.1
• CVE-2025-58436OpenPrinting CUPS is an open source printing system for Linu…5.5
• CVE-2025-58437Coder allows organizations to provision remote development e…8.1
• CVE-2025-58438internetarchive is a Python and Command-Line Interface to Ar…9.4