ZimaOS version 1.5.2-beta3 contains a path traversal vulnerability where API restrictions can be bypassed to create files in sensitive system directories. The frontend enforces path restrictions but the API does not properly validate target paths, allowing unauthorized operations on critical directories like /etc and /usr. This affects ZimaOS, a fork of CasaOS for Zima devices and x86-64 systems. No patch is currently available for this vulnerability.