An improper input validation vulnerability in ZimaOS version 1.5.2-beta3 allows authenticated attackers to perform unauthorized deletion of critical system files, potentially leading to a total system compromise.

This vulnerability involves improper input validation and broken access control (CWE-73) where the API fails to verify if a requested file path resides in a protected directory. An authenticated user can bypass interface restrictions by directly interacting with the API and supplying a manipulated path parameter to delete arbitrary system files.

The ability to delete arbitrary internal system files poses a severe risk to system integrity and availability. Given the high CVSS score of 8.5, this flaw could lead to a permanent denial of service or the destruction of critical configuration data, resulting in significant operational downtime and potential data loss.

Immediate Action: As no vendor patch is currently available, administrators should restrict access to the ZimaOS API to trusted users only and implement strict network segmentation to limit exposure.

Proactive Monitoring: Monitor system logs for unusual API requests, particularly those involving file deletion commands or attempts to traverse directory structures outside of intended user directories.

Compensating Controls: Deploy a Web Application Firewall (WAF) or equivalent API gateway rules to sanitize and validate incoming requests, specifically blocking attempts to access sensitive system paths or directories.

Public Exploit Available: Unknown.

The severity of this vulnerability is high due to its potential for total system impact. Organizations should prioritize restricting API access and closely monitoring system logs until a formal security update is released by IceWhaleTech. Users are advised to track the referenced GitHub advisory for updates regarding a permanent remediation.