CVE-2025-64427

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2025-64427
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-64427.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2025-64427
Aliases
  • GHSA-m8hj-7xg5-p375
Published
2026-03-02T16:28:42.534Z
Modified
2026-03-02T19:54:32.044068Z
Severity
  • 7.1 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:L CVSS Calculator
Summary
ZimaOS is vulnerable to Server-Side Request Forgery (SSRF)
Details

ZimaOS is a fork of CasaOS, an operating system for Zima devices and x86-64 systems with UEFI. In version 1.5.0 and prior, due to insufficient validation or restriction of target URLs, an authenticated local user can craft requests that target internal IP addresses (e.g., 127.0.0.1, localhost, or private network ranges). This allows the attacker to interact with internal HTTP/HTTPS services that are not intended to be exposed externally or to local users. No known patch is publicly available.

Database specific 
{
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
        "CWE-200",
        "CWE-918"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/64xxx/CVE-2025-64427.json"
}
References

Affected packages

Git / github.com/icewhaletech/zimaos

Affected ranges

Type
GIT
Repo
https://github.com/icewhaletech/zimaos
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
76df65ac82f85bc318fe95556ffb67decde3ae2b
Database specific 
{
    "versions": [
        {
            "introduced": "0"
        },
        {
            "fixed": "1.5.0"
        }
    ]
}

Affected versions

0.*
0.4.8
0.4.8.1
0.4.9
0.4.9.1
0.4.9.2
0.4.9.3
0.4.9.4
0.5.0
1.*
1.0.0
1.1.0
1.2.2
1.2.3
1.2.3-beta1
1.2.4
1.2.4-beta1
1.2.4-beta2
1.2.5
1.2.5-beta1
1.2.5-beta2
1.2.5-beta3
1.3.0
1.3.0-1
1.3.0-2
1.3.0-beta1
1.3.1
1.3.1-1
1.3.1-beta1
1.3.2
1.3.2-1
1.3.2-beta1
1.3.2-beta2
1.3.3
1.3.3-beta1
1.4.0
1.4.0-beta1
1.4.0-beta2
1.4.1
1.4.1-beta1
1.4.1-beta2
1.4.2
1.4.2-beta1
1.4.2-beta2
1.4.3
1.4.4
1.4.4-1
1.4.4-beta1
1.5.0-beta1

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-64427.json"