CVE-2025-64427: SSRF in ZimaOS

The SSRF vulnerability in ZimaOS allows an attacker with local, authenticated access to craft requests that bypass intended security boundaries. By manipulating the target URL, an attacker can send requests to internal services that are not meant to be accessible from the outside. This could include accessing internal APIs, databases, or other sensitive resources. The potential impact ranges from information disclosure to potentially gaining control over internal systems, depending on the services exposed and the attacker's ability to exploit them. This vulnerability shares similarities with other SSRF exploits where internal network scanning and service discovery are leveraged to identify exploitable targets.

1. Reserved2025-11-03
2. Published2026-03-02
3. Modified2026-03-03
4. EPSS updated2026-03-23

The primary mitigation for CVE-2025-64427 is to upgrade ZimaOS to version 1.5.0 or later, which includes the necessary fixes to prevent the SSRF vulnerability. If upgrading is not immediately feasible, consider implementing temporary workarounds such as restricting outbound network access from the ZimaOS instance using a firewall or network segmentation. Additionally, configure a Web Application Firewall (WAF) to filter requests containing suspicious URLs or internal IP addresses. Regularly review and audit ZimaOS configurations to ensure adherence to security best practices.