CVE-2026-28286

creationtimestamp| type| source ---|---|--- 2026-03-02 17:19:58+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mg3r7vqrqq26 2026-03-02 17:54:07+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mg3t4yydrw2o 2026-03-05 16:00:15+00:00| seen|...

CVE-2026-28286 ZimaOS: Unauthorized Creation of Files/Folders in Restricted System Directories via API

ZimaOS is a fork of CasaOS, an operating system for Zima devices and x86-64 systems with UEFI. In version 1.5.2-beta3, the application enforces restrictions in the frontend/UI to prevent users from creating files or folders in internal OS paths. However, when interacting directly with the API, th...