Improper Input Validation and Access Control in ZimaOS by IceWhaleTech

CVE-2026-28442

What is CVE-2026-28442?

In ZimaOS, a fork of CasaOS, version 1.5.2-beta3 exposes users to significant security risks due to improper input validation and broken access control. Although the user interface restricts the deletion of internal system files, these controls can be bypassed via direct API interactions. By manipulating the path parameter in delete requests, users can successfully remove sensitive OS files and directories, as the backend fails to validate whether the targeted path is part of the restricted system locations. This vulnerability underscores critical flaws in access management and poses a serious risk to system integrity.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References