An authenticated path traversal vulnerability in IceWhaleTech ZimaOS version 1.5.2-beta3 allows attackers to perform unauthorized file operations on critical system directories.

The vulnerability stems from improper validation of target paths within the application API, which fails to enforce the same directory restrictions present in the frontend. An authenticated attacker can leverage this oversight to gain arbitrary file write access to sensitive system directories such as /etc or /usr.

The ability to write arbitrary files to critical system directories poses a severe risk to the integrity and availability of the affected ZimaOS devices. With a CVSS score of 8.5, this high-severity flaw could allow an attacker to escalate privileges, inject malicious configuration files, or cause system-wide instability, leading to significant operational downtime and potential data compromise.

Immediate Action: As no official patch is currently available, administrators should restrict API access to trusted users and monitor for unusual file system activity.

Proactive Monitoring: Review system logs for unauthorized attempts to modify files in sensitive directories and monitor API traffic for requests containing directory traversal patterns.

Compensating Controls: Implement a Web Application Firewall (WAF) to filter and block requests containing path manipulation characters or attempts to target restricted system paths.

Public Exploit Available: Yes, a public proof-of-concept exists as documented in the GitHub repository hosted by Rushi9.

Given the high CVSS score and the existence of a public proof-of-concept, users of ZimaOS version 1.5.2-beta3 must prioritize the protection of the management interface. Until an official update is released, organizations should treat this vulnerability with high urgency and implement strict network access controls to limit exposure.