CVE-2026-28286 - Vulnerability Analysis

Overview

ZimaOS 1.5.2-beta3 contains a broken access control vulnerability caused by insufficient validation of file path inputs in the API, letting attackers create files or directories in restricted system paths, exploit requires direct API access.

Severity & Score

Impact

Attackers can create files or directories in critical system paths, potentially leading to system compromise or data tampering.

Mitigation

Update to the latest version once a patch is available.

References

• https://github.com/IceWhaleTech/ZimaOS/security/advisories/GHSA-65mg-9gw5-vr7g

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner