CVE-2026-28442: ZimaOS Path Traversal Vulnerability

CVE-2026-28442 Overview

CVE-2026-28442 is a high-severity vulnerability affecting ZimaOS, a fork of CasaOS designed for Zima devices and x86-64 systems with UEFI. The vulnerability exists in version 1.5.2-beta3 and involves improper input validation combined with broken access control on sensitive filesystem operations.

While the ZimaOS application interface restricts users from deleting internal system files or folders, these protections can be bypassed when interacting directly with the API. By manipulating the path parameter in delete requests, attackers can successfully remove internal OS files and directories. The backend processes these manipulated requests without validating whether the targeted path belongs to restricted system locations.

Critical Impact

Authenticated attackers can bypass access controls to delete critical system files and directories, potentially leading to complete system compromise, denial of service, or privilege escalation through the destruction of security configurations.

Affected Products

• ZimaOS version 1.5.2-beta3
• Systems running ZimaOS on x86-64 hardware with UEFI
• Installations derived from CasaOS fork architecture

Discovery Timeline

• 2026-03-05 - CVE-2026-28442 published to NVD
• 2026-03-05 - Last updated in NVD database

Technical Details for CVE-2026-28442

Vulnerability Analysis

This vulnerability is classified under CWE-73 (External Control of File Name or Path), which occurs when software allows user input to control or influence paths used in filesystem operations. The fundamental security flaw lies in the disconnect between the UI-level access controls and the API-level enforcement.

The ZimaOS application implements restrictions at the user interface layer to prevent deletion of system-critical files and directories. However, these restrictions are not mirrored at the API level. When a user or attacker sends requests directly to the backend API—bypassing the application interface—the server processes these requests without performing adequate validation on the requested file paths.

This architectural weakness allows path traversal attacks where an attacker can manipulate the path parameter to target directories outside of the intended user-accessible scope. The impact is particularly severe because successful exploitation can result in the deletion of critical operating system files, security configurations, or authentication databases.

Root Cause

The root cause of CVE-2026-28442 is a combination of two security weaknesses:

1. Improper Input Validation: The API does not properly validate or sanitize the path parameter in delete requests. This allows attackers to include path traversal sequences or specify absolute paths to system directories.

2. Broken Access Control: Security restrictions implemented in the frontend application are not enforced at the backend API level. The system trusts that all requests come through the controlled application interface, violating the principle of defense in depth.

The backend appears to process file deletion requests without checking whether the target path resides within allowed user directories or protected system locations.

Attack Vector

The attack leverages direct API interaction to bypass frontend restrictions. An authenticated attacker with low privileges can craft malicious API requests that target system-critical paths.

The attack flow involves:

1. The attacker authenticates to the ZimaOS system to obtain valid API credentials or session tokens
2. Instead of using the application interface, the attacker sends crafted HTTP requests directly to the file deletion API endpoint
3. The path parameter is manipulated to target system files, potentially using path traversal techniques such as ../ sequences or absolute paths
4. The backend processes the request without validating path restrictions, executing the deletion operation
5. Critical system files are removed, potentially causing system instability, denial of service, or security compromise

Since no verified code examples are available, refer to the GitHub Security Advisory for additional technical details on the exploitation mechanism.

Detection Methods for CVE-2026-28442

Indicators of Compromise

• Unexpected deletions of system files or directories in ZimaOS logs
• API requests to file deletion endpoints containing path traversal sequences like ../ or absolute system paths
• Authentication logs showing direct API access without corresponding application interface activity
• System instability or missing configuration files following suspicious API activity

Detection Strategies

• Monitor API endpoints for file operations and flag requests targeting paths outside of user home directories
• Implement alerting on path parameters containing traversal sequences such as .., /etc/, /var/, or other system-critical directories
• Audit authentication and authorization logs for direct API access patterns that bypass the application interface
• Deploy web application firewall (WAF) rules to detect and block path traversal attempts in API requests

Monitoring Recommendations

• Enable comprehensive logging for all file deletion API endpoints, including full request parameters and authenticated user context
• Implement file integrity monitoring (FIM) on critical system directories to detect unauthorized modifications or deletions
• Configure alerts for any API requests that receive successful responses while targeting restricted paths
• Review ZimaOS access logs regularly for anomalous patterns indicating API abuse

How to Mitigate CVE-2026-28442

Immediate Actions Required

• Restrict direct API access by implementing network-level controls such as firewall rules limiting API endpoint exposure
• Review and audit user accounts with API access, removing unnecessary privileges
• Implement additional authentication requirements for sensitive file operations if possible through reverse proxy configurations
• Consider taking affected ZimaOS systems offline if they are exposed to untrusted networks until a patch is available

Patch Information

No known public patch is currently available for CVE-2026-28442. Users should monitor the GitHub Security Advisory for updates from the ZimaOS development team regarding security fixes.

Until an official patch is released, organizations should implement the workarounds and mitigations described below to reduce exposure to this vulnerability.

Workarounds

• Place a reverse proxy in front of ZimaOS that validates path parameters and blocks requests containing path traversal patterns
• Restrict network access to ZimaOS API endpoints to trusted IP addresses or VPN connections only
• Implement read-only file system permissions on critical system directories at the OS level where operationally feasible
• Consider running ZimaOS in a containerized or sandboxed environment to limit the impact of successful exploitation

# Example: Restrict API access via iptables to trusted network only
# Adjust interface and IP ranges according to your environment
iptables -A INPUT -p tcp --dport 80 -s 192.168.1.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 443 -s 192.168.1.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 80 -j DROP
iptables -A INPUT -p tcp --dport 443 -j DROP