The vulnerability exists in the zrok2 copy command, which accepts user‑specified WebDAV or zrok drive paths. From versions 0.4.23 through 2.0.3, the command stores attacker‑controlled paths such as /../outside.txt in its source inventory and forwards them to FilesystemTarget.WriteStream. This causes the sync pipeline to write files outside the chosen local filesystem destination root, allowing an attacker to create or overwrite arbitrary files where the zrok process has write permission. The flaw is a directory traversal weakness classified as CWE‑22.

OpenZiti includes all zrok clients from version 0.4.23 up through but not including 2.0.3. Any system running those releases, regardless of operating system, is susceptible to the flaw until the user applies the 2.0.3 release or later.

The CVSS score of 8.3 indicates high severity; the EPSS of <1% suggests a low exposure rate. The vulnerability is not included in KEV. Attackers with the ability to invoke zrok2 copy and supply crafted paths can write arbitrary files, potentially corrupting configuration or inserting malware wherever the process can write, if the host filesystem allows it.