CVE-2026-28442

ZimaOS is a fork of CasaOS, an operating system for Zima devices and x86-64 systems with UEFI. In version 1.5.2-beta3, users are restricted from deleting internal system files or folders through the application interface. However, when interacting directly with the API, these restrictions can be bypassed. By altering the path parameter in the delete request, internal OS files and directories can be removed successfully. The backend processes these manipulated requests without validating whether the targeted path belongs to restricted system locations. This demonstrates improper input validation and broken access control on sensitive filesystem operations. No known public patch is available.

• CWE-73

• https://github.com/IceWhaleTech/ZimaOS/security/advisories/GHSA-q5hp-59wm-9xq3Exploit, Mitigation, Vendor Advisory
• https://github.com/IceWhaleTech/ZimaOS/security/advisories/GHSA-q5hp-59wm-9xq3Exploit, Mitigation, Vendor Advisory

Published

Mar 5, 2026

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-28433Misskey is an open source, federated social media platform. …4.3
• CVE-2026-28434cpp-httplib is a C++11 single-file header-only cross platfor…5.3
• CVE-2026-28435cpp-httplib is a C++11 single-file header-only cross platfor…7.5
• CVE-2026-28436Frappe is a full-stack web application framework. Prior to v…7.2
• CVE-2026-28438CocoIndex is a data transformation framework for AI. Prior t…9.8
• CVE-2026-2844Missing Authentication for Critical Function vulnerability i…7.5
• CVE-2026-28443OpenReplay is a self-hosted session replay suite. Prior to v…9.8
• CVE-2026-28444Typebot is a chatbot builder tool. In versions 3.15.2 and pr…6.5
• CVE-2026-28445Typebot is a chatbot builder tool. In versions 3.15.2 and pr…8.7
• CVE-2026-28446OpenClaw versions prior to 2026.2.1 with the voice-call exte…9.8
• CVE-2026-28447OpenClaw versions 2026.1.29-beta.1 prior to 2026.2.1 contain…6.5
• CVE-2026-28448OpenClaw versions 2026.1.29 prior to 2026.2.1 contain a vuln…9.4