The openziti zrok software, used for sharing web services, files, and network resources, contains a path traversal vulnerability in its Python SDK ProxyShare Flask proxy route. Before version 2.0.3, the proxy route accepts an absolute URL in the request path and passes it to urllib.parse.urljoin, which allows the requested path to replace the configured target host. This behavior enables an attacker to cause the server to make requests to arbitrary URLs chosen by the attacker, potentially exposing sensitive data or enabling further attacks. The vulnerability is identified as CWE-22 and has a CVSS 4.0 score of 9.9 (critical). The issue is resolved in version 2.0.3.

An attacker can exploit this vulnerability to cause the server to make requests to arbitrary URLs controlled by the attacker. This can lead to unauthorized access to internal resources, data leakage, or other server-side request forgery impacts. The vulnerability has a critical severity with a CVSS score of 9.9, indicating high impact and ease of exploitation without privileges or user interaction.

This vulnerability is fixed in openziti zrok version 2.0.3. Users should upgrade to version 2.0.3 or later to remediate this issue. Patch status is confirmed by the vendor advisory indicating the fix in 2.0.3. No other mitigation guidance is provided or required.