CVE-2025-58431: Zimaspace ZimaOS Information Disclosure

CVE-2025-58431 Overview

CVE-2025-58431 affects ZimaOS, a fork of CasaOS designed for Zima devices and x86-64 systems with UEFI. The /v2_1/files/file/download endpoint in version 1.4.1 and earlier allows any user with access to localhost to read arbitrary files. The endpoint performs file reads as root, bypassing filesystem permissions and exposing sensitive system content.

The issue is classified under [CWE-250]: Execution with Unnecessary Privileges. Attackers with local access to the ZimaOS host, or any process bound to localhost, can retrieve files that should be restricted, including configuration files, credentials, and secrets stored on the appliance.

Critical Impact
Local users and localhost-bound services can read any file on the system as root, leading to disclosure of credentials, configuration data, and other sensitive material.

Affected Products

ZimaOS version 1.4.1
All prior ZimaOS releases
Zima devices and x86-64 UEFI systems running vulnerable ZimaOS builds

Discovery Timeline

2025-09-17 - CVE-2025-58431 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-58431

Vulnerability Analysis

The /v2_1/files/file/download endpoint in ZimaOS exposes a file download handler that runs with root privileges. The endpoint does not enforce path restrictions or user-scoped authorization for callers reaching it through localhost. Any client able to bind to or reach the loopback interface can request arbitrary filesystem paths.

Because the process performing the read executes as root, standard Unix permissions do not limit which files can be returned. Files such as /etc/shadow, service configuration under /etc, container secrets, and application databases become readable through a single HTTP request.

The root cause aligns with [CWE-250]: the download service holds higher privileges than needed for the operation it performs. Combined with missing path validation and missing per-user authorization on the localhost surface, the design pattern converts routine local access into a full filesystem disclosure primitive.

Root Cause

The file download handler runs with elevated privileges and trusts requests originating from localhost without enforcing per-user access control or restricting readable paths. The handler treats loopback callers as implicitly authorized and lacks a chroot or path allowlist to constrain what root can read on behalf of the caller.

Attack Vector

Exploitation requires local access. An attacker with a shell on the ZimaOS host, or code execution inside a container or service that can reach loopback, issues an HTTP GET to /v2_1/files/file/download with a target path parameter. The service returns the file contents as root, regardless of the requesting user's identity.

Refer to the GitHub Security Advisory GHSA-vqrw-9v9m-6g87 for the vendor's technical description of the affected endpoint.

Detection Methods for CVE-2025-58431

Indicators of Compromise

HTTP requests to /v2_1/files/file/download originating from loopback with paths pointing outside expected download directories.
Access log entries showing retrieval of sensitive paths such as /etc/shadow, /root/, or application secret files via the ZimaOS API.
Unexpected reads of ZimaOS or container configuration files by non-administrative local users.

Detection Strategies

Monitor ZimaOS API access logs for requests to the /v2_1/files/file/download endpoint and alert on path parameters referencing system directories.
Baseline normal file download activity per user and flag localhost-originated requests that deviate from typical file-management workflows.
Correlate local process activity with API calls to identify low-privileged processes triggering root-level file reads.

Monitoring Recommendations

Enable verbose logging on the ZimaOS web service and forward logs to a centralized platform for analysis.
Track filesystem audit events for reads of high-value files initiated by the ZimaOS service account or its subprocesses.
Alert on new local user accounts, container deployments, or services that begin communicating with the ZimaOS API on loopback.

How to Mitigate CVE-2025-58431

Immediate Actions Required

Upgrade ZimaOS to a fixed release published after version 1.4.1 as identified in the vendor advisory.
Restrict local shell access and container privileges on ZimaOS hosts to trusted administrators only.
Audit existing local accounts and running services for unauthorized access to the ZimaOS API.

Patch Information

The maintainers of ZimaOS have published details in the GitHub Security Advisory GHSA-vqrw-9v9m-6g87. Apply the fixed version referenced in that advisory to remove the privileged localhost download path.

Workarounds

Block or firewall access to the ZimaOS API from untrusted local processes and containers where feasible.
Reduce the number of local users and services with network access to loopback on the ZimaOS host.
Review container and application deployments to ensure workloads do not run with unnecessary access to the ZimaOS management interface.

bash

# Verify installed ZimaOS version and review API access logs
cat /etc/zimaos/version 2>/dev/null || zimaos --version
journalctl -u zimaos --since "7 days ago" | grep "/v2_1/files/file/download"