Vulnerability · Published Mar 2, 2026 · Assigned by GitHub_M

CVE-2025-64427ZimaOS is vulnerable to Server-Side Request Forgery (SSRF)

High 7.1

In plain English

A high-severity server-side request forgery in ZimaOS from IceWhaleTech. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 19% of all known vulnerabilities).

Severity (CVSS 3.1)7.1High

Exploit odds (30 days)0.3%top 80.6% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

ZimaOS is a fork of CasaOS, an operating system for Zima devices and x86-64 systems with UEFI. In version 1.5.0 and prior, due to insufficient validation or restriction of target URLs, an authenticated local user can craft requests that target internal IP addresses (e.g., 127.0.0.1, localhost, or private network ranges). This allows the attacker to interact with internal HTTP/HTTPS services that are not intended to be exposed externally or to local users. No known patch is publicly available.

Affected products (as reported)

Vendor	Product	Versions
IceWhaleTech	ZimaOS	< 1.5.0

Weakness: CWE-918, CWE-200 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:L

References

https://github.com/IceWhaleTech/ZimaOS/security/advisories/GHSA-m8hj-7xg5-p375 x_refsource_CONFIRM