{"cve":"CVE-2026-42275","nvd":{"published":"2026-05-08T04:16:22.823","modified":"2026-10-26T20:10:00.160","status":"Analyzed","description":"zrok is software for sharing web services, files, and network resources. Prior to version 2.0.2, the zrok WebDAV drive backend (davServer.Dir) restricts path traversal through lexical normalization but does not prevent symlink following. When a symbolic link inside the shared DriveRoot points to a location outside that root, remote WebDAV consumers can read files and—on shares without OS-level permission restrictions—write or overwrite files anywhere on the host filesystem accessible to the zrok process. This issue has been patched in version 2.0.2.","cvss_v4":null,"cvss_v3":{"version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N","score":8.7},"cwes":["CWE-22","CWE-61"],"references":["https://github.com/openziti/zrok/commit/459bcfc1e121decae1b1d11c37ad94e4ed5bbf2e","https://github.com/openziti/zrok/releases/tag/v2.0.2","https://github.com/openziti/zrok/security/advisories/GHSA-74m3-9qvm-rp9h"],"products":["netfoundry:zrok"],"source":"nvd","synced_at":"2026-10-26T20:34:58.897451322+00:00"},"epss":{"cve":"CVE-2026-42275","score":0.0033,"percentile":0.25914,"date":"2026-10-26"},"kev":null,"osv":[{"id":"GHSA-74m3-9qvm-rp9h","url":"https://osv.dev/vulnerability/GHSA-74m3-9qvm-rp9h","summary":"zrok: WebDAV drive backend follows symlinks outside DriveRoot, enabling host filesystem read/write","modified":"2026-06-25T19:56:16.450779470Z","packages":[{"ecosystem":"Go","name":"github.com/openziti/zrok","purl":"pkg:golang/github.com/openziti/zrok","ranges":["<=1.1.11"],"fixed":[]},{"ecosystem":"Go","name":"github.com/openziti/zrok/v2","purl":"pkg:golang/github.com/openziti/zrok/v2","ranges":["<2.0.2"],"fixed":["2.0.2"]}]},{"id":"GO-2026-5203","url":"https://osv.dev/vulnerability/GO-2026-5203","summary":"zrok: WebDAV drive backend follows symlinks outside DriveRoot, enabling host filesystem read/write in github.com/openziti/zrok","modified":"2026-06-25T19:45:16.253380708Z","packages":[{"ecosystem":"Go","name":"github.com/openziti/zrok","purl":"pkg:golang/github.com/openziti/zrok","ranges":["all versions"],"fixed":[]},{"ecosystem":"Go","name":"github.com/openziti/zrok/v2","purl":"pkg:golang/github.com/openziti/zrok/v2","ranges":["<2.0.2"],"fixed":["2.0.2"]}]}],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}