Repository navigation
Security: IceWhaleTech/ZimaOS
Security Advisories
View known security vulnerabilities and report new vulnerabilities privately to maintainers.
-
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')GHSA-gq27-h664-6xp4 published
Sep 16, 2026 by atopos31High -
ZimaOS v1.5.2-beta3 - Arbitrary Deletion of Internal System Files via API Path ManipulationGHSA-q5hp-59wm-9xq3 published
Feb 28, 2026 by atopos31High -
ZimaOS v1.5.2-beta3 - Unauthorized Creation of Files/Folders in Restricted System Directories via APIGHSA-65mg-9gw5-vr7g published
Feb 28, 2026 by atopos31High -
Arbitrary internal service access via /v1/sys/proxy when Cloudflare Tunnel is enabled on ZimaOSGHSA-vqqj-f979-8c8m published
Mar 31, 2026 by atopos31Critical -
Authentication Bypass via System-Level UsernameGHSA-xj93-qw9p-jxq4 published
Jan 6, 2026 by LinkLeongCritical -
ZimaOS 1.5.0 Regression - /v1/users/name discloses usernames without auth (GHSA-9mrr-px2c-w42c)GHSA-57r9-43pc-gcp2 published
Nov 5, 2025 by LinkLeongModerate -
Server-Side Request Forgery (SSRF)GHSA-m8hj-7xg5-p375 published
Mar 2, 2026 by atopos31High -
Arbitrary File Read using localhost calls to File API DownloadGHSA-vqrw-9v9m-6g87 published
Sep 17, 2025 by LinkLeongModerate -
Privilege Escalation using localhost calls to File API UploadGHSA-3gp9-43rg-xrcc published
Sep 17, 2025 by LinkLeongModerate -
Unauthenticated API Discloses Usernames ZimaOSGHSA-9mrr-px2c-w42c published
Oct 24, 2024 by LinkLeongModerate
