Back to Database
Status published
Medium
CVE-2025-58432
ZimaOS Privilege Escalation using localhost calls to File API Upload
Vulnerability Description
ZimaOS is a fork of CasaOS, an operating system for Zima devices and x86-64 systems with UEFI. In version 1.4.1 and all prior versions, the /v2_1/files/file/uploadV2 endpoint allows file upload from ANY USER who has access to localhost. File uploads are performed AS ROOT.
Impact Analysis
Refer to official advisory for detailed impact metrics.
Remediation
Ensure systems are updated to the latest vendor-supplied patch levels.
THREAT MONITOR
Am I Vulnerable?
Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2025-58432
Credits & Attribution
No credits recorded in the NVD database.
More from IceWhaleTech
View All →CVE-2025-64427
ZimaOS is vulnerable to Server-Side Request Forgery (SSRF)
High
7.1
CVE-2025-58431
ZimaOS reads arbitrary files using localhost calls to File API Download
Medium
4.8
CVE-2024-49359
ZimaOS vulnerable to Directory Listing via Parameter Manipulation
High
7.5
CVE-2024-49358
ZimaOS vulnerable to Username Enumeration via API Responses
Medium
5.3
CVE-2024-49357
ZimaOS (Installed Applications and System Information) has Unauthorized Sensitive Data Leak
High
7.5
Affected Vendor
IceWhaleTech
View all reports →Affected Software
ZimaOS
Vulnerable Versions:
<= 1.4.1
Timeline
Official Publish:
September 17th, 2025
Last Modified:
September 17th, 2025
Added to House:
July 22nd, 2026
CVSS Vectors
MITRE ATT&CK TTPs
T1068
Exploitation for Privilege Escalation
Privilege Escalation
T1548
Abuse Elevation Control Mechanism
Defense Evasion
T1078
Valid Accounts
Persistence
T1574
Hijack Execution Flow
Privilege Escalation
T1485
Data Destruction
Impact
T1098
Account Manipulation
Privilege Escalation
T1222
File and Directory Permissions Modification
Defense Evasion
T1134
Access Token Manipulation
Defense Evasion