CVE-2025-34171: Missing Authorization

CasaOS versions up to and including 0.4.15 expose multiple unauthenticated endpoints that allow remote attackers to retrieve sensitive configuration files and system debug information. The /v1/users/image endpoint can be abused with a user-controlled path parameter to access files under...

CVE-2024-49357: Exposure of Sensitive Information to an Unauthorized Actor

ZimaOS is a fork of CasaOS, an operating system for Zima devices and x86-64 systems with UEFI. In version 1.2.4 and all prior versions, the API endpoints in ZimaOS, such as http:// /v1/users/image?path=/var/lib/casaos/1/apporder.json and http:// /v1/users/image?path=/var/lib/casaos/1/system.json,...