CVE-2026-28442 - Vulnerability Analysis

Overview

ZimaOS 1.5.2-beta3 contains a broken access control vulnerability caused by improper validation of the path parameter in delete requests, letting attackers delete internal system files via the API, exploit requires API access.

Severity & Score

Impact

Attackers can delete critical system files, potentially causing system instability or denial of service.

Mitigation

Update to the latest version once a patch is available or implement proper path validation and access controls.

References

• https://github.com/IceWhaleTech/ZimaOS/security/advisories/GHSA-q5hp-59wm-9xq3

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner