CVE-2025-58432 – ZimaOS Privilege Escalation using localhost calls to File API Upload

CVE ID : CVE-2025-58432

Published : Sept. 17, 2025, 6:15 p.m. | 44 minutes ago

Description : ZimaOS is a fork of CasaOS, an operating system for Zima devices and x86-64 systems with UEFI. In version 1.4.1 and all prior versions, the /v2_1/files/file/uploadV2 endpoint allows file upload from ANY USER who has access to localhost. File uploads are performed AS ROOT.

Severity: 5.2 | MEDIUM

Visit the link for more details, such as CVSS details, affected products, timeline, and more…