The vulnerability in openziti zrok affects the 'zrok2 copy' command, which improperly limits pathname inputs to a restricted directory. Specifically, attacker-controlled WebDAV or zrok drive paths containing traversal sequences like '/../outside.txt' can be stored in the source inventory and passed to FilesystemTarget.WriteStream. This allows the sync pipeline to write files outside the selected local filesystem destination root, leading to potential unauthorized file writes. The issue is resolved in version 2.0.3.

An attacker can cause the application to write files outside the intended directory, potentially overwriting or creating arbitrary files on the local filesystem. This can lead to unauthorized file modification or creation, which may impact system integrity or security. The CVSS 4.0 score is 8.3 (high severity), indicating a significant risk if exploited.

Upgrade openziti zrok to version 2.0.3 or later, where this path traversal vulnerability is fixed. Patch status is not explicitly stated as 'official-fix' in the advisory, but the description confirms the issue is resolved in 2.0.3. No additional vendor advisory content is provided. Until upgrade, avoid using untrusted input for paths in 'zrok2 copy' operations.