CVE-2026-28286 - Vulnerability Analysis

Overview

ZimaOS 1.5.2-beta3 contains a broken access control vulnerability caused by insufficient validation of file path inputs in the API, letting attackers create files or directories in restricted system paths, exploit requires direct API access.

Severity & Score

Impact

Attackers can create files or directories in critical system paths, potentially leading to system compromise or data tampering.

Mitigation

Update to the latest version once a patch is available.

References

• https://github.com/IceWhaleTech/ZimaOS/security/advisories/GHSA-65mg-9gw5-vr7g

Social Media Activity(1 post)

TheHackerWire

@thehackerwire

Mar 2, 2026

🟠 CVE-2026-28286 - High (8.5) ZimaOS is a fork of CasaOS, an operating system for Zima devices and x86-64 systems with UEFI. In version 1.5.2-beta3, the application enforces restrictions in the frontend/UI to prevent users from creating files or folders in internal OS paths. H... 🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-28286/ #CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

View original post

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner