File Upload Vulnerability in ZimaOS Affects Root Access
CVE-2025-58432

5.2MEDIUM

Key Information:

Vendor

Icewhaletech

Status
Zimaos
Vendor
CVE Published:
17 September 2025

What is CVE-2025-58432?

ZimaOS, derived from CasaOS and designed for Zima devices and x86-64 systems, has a vulnerability in the file upload functionality. The /v2_1/files/file/uploadV2 endpoint is exposed, allowing any user with local access to upload files to the system, which are executed with root privileges. This presents a significant security risk, as it can enable malicious users to compromise the integrity and confidentiality of the system. Upgrades beyond version 1.4.1 are necessary to mitigate this vulnerability.

Affected Version(s)

ZimaOS <= 1.4.1

References

https://github.com/IceWhaleTech/ZimaOS/security/advisorie...
x_refsource_CONFIRM

CVSS V4

Score:
5.2
Severity:
MEDIUM
Confidentiality:
None
Integrity:
High
Availability:
None
Attack Vector:
Local
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
Unknown

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.
CVE-2025-58432 : File Upload Vulnerability in ZimaOS Affects Root Access