Overview

This report outlines a critical vulnerability found in ZimaOS, a fork of CasaOS, specifically used on Zima devices and x86-64 systems with UEFI. The vulnerability, designated as CVE-2025-58432, allows for unauthorized file upload from any user having access to localhost. Given its severity, the vulnerability poses a significant risk to system security, potentially leading to system compromise or data leakage.

Vulnerability Summary

CVE ID: CVE-2025-58432
Severity: High (7.8/10)
Attack Vector: Network
Privileges Required: None
User Interaction: None
Impact: System compromise or data leakage

Affected Products

Product | Affected Versions

ZimaOS | 1.4.1 and prior versions

How the Exploit Works

The vulnerability lies in the /v2_1/files/file/uploadV2 endpoint of ZimaOS. This endpoint allows file uploads from any user who can access localhost. More importantly, these file uploads are performed with root privileges, bypassing the typical security measures in place. As such, an attacker could exploit this to upload malicious files or scripts, potentially leading to system compromise or data leakage.

Conceptual Example Code

Below is a conceptual example of how this vulnerability might be exploited:

POST /v2_1/files/file/uploadV2 HTTP/1.1
Host: localhost
Content-Type: application/octet-stream
{ "file": "<malicious_file>", "filename": "<chosen_filename>" }

In the above example, an attacker could replace `` and `` with a malicious file and a chosen filename, respectively, to exploit the vulnerability.

Mitigation

Users are advised to apply vendor patches as soon as they become available. In the interim, the use of a Web Application Firewall (WAF) or Intrusion Detection System (IDS) can serve as a temporary mitigation measure. These systems can monitor and block suspicious activity, helping to prevent the exploitation of this vulnerability.