CasaOS vulnerabilities
4 known CVE vulnerabilities in CasaOS, translated and rated.
- CVE-2023-37266Critical
CasaOS is an open-source Personal Cloud system. Unauthenticated attackers can craft arbitrary JWTs and access features that usually require authentication and execute arbitrary commands as `root` on CasaOS instances.
- CVE-2023-37265Critical
CasaOS is an open-source Personal Cloud system. Due to a lack of IP address verification, unauthenticated attackers can execute arbitrary commands as `root` on CasaOS instances.
- CVE-2025-34171Medium
CasaOS versions up to and including 0.4.15 expose multiple unauthenticated endpoints that allow remote attackers to retrieve sensitive configuration files and system debug information. The /v1/users/image and /v1/sys/debug endpoints can be abused to access files and disclose host OS, kernel, hardware, and storage details.
- CVE-2023-37469High
CasaOS is an open-source personal cloud system. Prior to version 0.4.4, an authenticated user who successfully connects to a controlled SMB server can execute arbitrary commands.