CVE-2025-58431
BaseFortify
Publication date: 2025-09-17
Last updated on: 2025-09-22
Assigner: GitHub, Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| zimaspace | zimaos | to 1.4.1 (inc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-250 | The product performs an operation at a privilege level that is higher than the minimum level required, which creates new weaknesses or amplifies the consequences of other weaknesses. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability exists in ZimaOS version 1.4.1 and earlier, where the /v2_1/files/file/download endpoint allows any user with access to localhost to read files. The file reads are performed with root privileges, meaning an attacker with local access can read any file on the system as the root user.
How can this vulnerability impact me? :
This vulnerability can allow an attacker with local access to read any file on the system with root privileges, potentially exposing sensitive information, system files, or credentials. This can lead to unauthorized data disclosure and further system compromise.