CVE-2025-58431

MEDIUM

ZimaOS < 1.4.1 - Unauthenticated Arbitrary File Read as Root via /v2_1/files/file/download Endpoint

Title source: llm
STIX 2.1

Description

ZimaOS is a fork of CasaOS, an operating system for Zima devices and x86-64 systems with UEFI. In version 1.4.1 and earlier, the /v2_1/files/file/download endpoint allows file read from ANY USER who has access to localhost. File reads are performed AS ROOT.

References (1)

Core 1
Core References
Exploit, Third Party Advisory x_refsource_confirm
https://github.com/IceWhaleTech/ZimaOS/security/advisories/GHSA-vqrw-9v9m-6g87

Scores

CVSS v3 6.2
EPSS 0.0019
EPSS Percentile 8.9%
Attack Vector LOCAL
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

CISA SSVC

Vulnrichment
Exploitation poc
Automatable no
Technical Impact partial

Details

CWE
CWE-250
Status published
Products (1)
zimaspace/zimaos < 1.4.1
Published Sep 17, 2025
Tracked Since Feb 18, 2026