CVE-2025-58431
ZimaOS reads arbitrary files using localhost calls to File API Download
Summary
ZimaOS reads arbitrary files using localhost calls to File API Download
Original description
The description as published by the source.
ZimaOS is a fork of CasaOS, an operating system for Zima devices and x86-64 systems with UEFI. In version 1.4.1 and earlier, the /v2_1/files/file/download endpoint allows file read from ANY USER who has access to localhost. File reads are performed AS ROOT.
Source: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV
References
- advisory github.com
- advisory github.com
- advisory nvd.nist.gov