An API endpoint in ZimaOS does not properly validate the target file path. By crafting a request with a path such as /etc or /usr, the API can create files or directories in system locations that normal users should not have write access to. This flaw allows an attacker to add or modify system files through the API, potentially disrupting configuration or creating a foothold for further exploitation.

The vulnerability exists in IceWhaleTech ZimaOS version 1.5.2‑beta3. No other versions or related products are listed in the advisory.

The defect is rated high with a CVSS score of 8.6, while the EPSS probability is below 1% and it is not listed in the CISA KEV catalog. Exploitation requires only that an attacker can reach the vulnerable API endpoint; the path‑validation bypass enables file operations regardless of the caller’s privileges. The risk is elevated for installations that expose the API to untrusted networks or users who can send bespoke requests.