CVE-2025-58431
ZimaOS reads arbitrary files using localhost calls to File API Download
Résumé
ZimaOS reads arbitrary files using localhost calls to File API Download
Description d'origine
La description telle que publiée par la source (souvent en anglais).
ZimaOS is a fork of CasaOS, an operating system for Zima devices and x86-64 systems with UEFI. In version 1.4.1 and earlier, the /v2_1/files/file/download endpoint allows file read from ANY USER who has access to localhost. File reads are performed AS ROOT.
Source: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV
Références
- advisory github.com
- advisory github.com
- advisory nvd.nist.gov