CVE-2026-28286 is a flaw in ZimaOS, the CasaOS fork for Zima devices, where the API does not validate target paths. A user who should have no write access can create files and folders in system directories. NVD scores it 8.5. The GitHub advisory lists version 1.5.3 as patched.
What's affected
The GitHub advisory GHSA-65mg-9gw5-vr7g lists affected version ZimaOS 1.5.2-beta3 and patched version 1.5.3.
There is a discrepancy to be aware of. The NVD description says no known patch is publicly available, while the advisory's patched versions field says 1.5.3. Both can be true at different moments in time, so check the ZimaOS release notes and your update channel before you rely on either statement.
The advisory describes the problem like this: the interface blocks users from creating files in internal operating system paths, but the API behind it does not enforce the same rule. The restriction exists in the front end and not in the back end. The advisory scores it 8.5 (High) with network attack vector, high complexity and low privileges required, so an authenticated account is a precondition.
How to check if you're exposed
Check the installed ZimaOS version in the system settings or about page. Anything on 1.5.2-beta3 is the version named in the advisory. If you are on a different beta or release, read the advisory and ZimaOS release notes to see whether you are covered.
Then check who has accounts on the device and whether the web interface is reachable from outside your home or office network. A device on a private network with a single trusted user is in a very different position from a shared device exposed to the internet.
What to do now
- Update ZimaOS to 1.5.3 or later, which the advisory lists as patched, and confirm the version afterwards.
- Do not expose the ZimaOS web interface or API to the internet. Use a VPN for remote access.
- Review the user accounts on the device and remove any that are not needed.
- Check system directories for unexpected new files or folders if the device was reachable by untrusted users. The advisory gives no indicators, so look for anything you did not create.
- Keep a current backup of your data off the device.
Why it matters
The weakness is CWE-73 (External Control of File Name or Path). The server takes a path from the request and uses it without checking that the path is somewhere the user is allowed to write. The advisory's own remediation advice is the standard one: validate and canonicalize paths on the server, restrict file operations to a base directory, and use an allow list.
The deeper lesson is about where checks live. A front end that blocks a bad action is a convenience, not a control, because anyone who can talk to the API can skip it. Every restriction that matters has to be enforced by the code that does the work.
Writing into system directories matters because those locations influence what the machine runs. The advisory lists code execution, privilege escalation, service disruption and takeover as potential outcomes.
The record does not flag exploitation in the wild, and the CVE is not in CISA's Known Exploited Vulnerabilities catalog.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Is there a patch or not?
The GitHub advisory lists 1.5.3 as the patched version. The NVD text says no known patch is publicly available. Check ZimaOS release notes to confirm.
Does an attacker need an account?
The scoring shows low privileges required, so an authenticated user is needed. Network exposure and the number of accounts on the device determine how much that matters for you.
Sources
Last reviewed: 19 October 2026.
