CVE-2026-28442

creationtimestamp| type| source ---|---|--- 2026-03-05 22:09:15+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mgdsrxp3e62z 2026-03-07 14:00:57+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mghygni6bt2t 2026-03-12 14:00:14+00:00| seen|...

CVE-2026-28442 ZimaOS: Arbitrary Deletion of Internal System Files via API Path Manipulation

ZimaOS is a fork of CasaOS, an operating system for Zima devices and x86-64 systems with UEFI. In version 1.5.2-beta3, users are restricted from deleting internal system files or folders through the application interface. However, when interacting directly with the API, these restrictions can be...