ZimaOS, a fork of CasaOS, exposed a web‑interface endpoint at /v1/sys/proxy that, prior to version 1.5.3, forwarded requests received through an externally reachable Cloudflare Tunnel to services listening on localhost. An attacker could send crafted traffic to this endpoint and reach any internal‑only service without authentication, potentially exposing sensitive data or enabling privileged operations. The weakness corresponds to CWE‑918, reflecting tainted input used to build a network request.

All deployments of IceWhaleTech’s ZimaOS before release 1.5.3 are vulnerable. The proxy endpoint was present across all builds prior to that version. Updating to 1.5.3 or later removes the vulnerable functionality.

The base CVSS score of 9.1 indicates a critical severity, and an EPSS score below 1 % suggests current exploitation activity is low. The vulnerability does not appear in known‑exploited vulnerability lists, but the presence of a publicly exposed HTTP endpoint and the ability to use a Cloudflare Tunnel significantly lower the barrier for exploitation. An attacker with control over a domain that can point to the tunnel could construct requests targeting the /v1/sys/proxy endpoint, achieving internal access without privileged credentials.