VYPR
← All advisories
Medium severity6.2NVD Advisory· Published Sep 17, 2025· Updated Jun 17, 2026

CVE-2025-58431

CVE-2025-58431

Description

ZimaOS is a fork of CasaOS, an operating system for Zima devices and x86-64 systems with UEFI. In version 1.4.1 and earlier, the /v2_1/files/file/download endpoint allows file read from ANY USER who has access to localhost. File reads are performed AS ROOT.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

3
  • Zimaspace/Zimaos
    cpe:2.3:o:zimaspace:zimaos:*:*:*:*:*:*:*:*
    Range: <=1.4.1
  • Icewhaletech/Zimaosllm-fuzzy2 versions
    <=1.4.1+ 1 more
    • (no CPE)range: <=1.4.1
    • (no CPE)range: <= 1.4.1

Patches

Vulnerability mechanics

References

1

News mentions

0

No linked articles in our index yet.