Vulnerability details
CVE-2026-42275
openziti zrok
zrok: WebDAV drive backend follows symlinks outside DriveRoot, enabling host filesystem read/write
CVSS 3.1
8.7High
Official description
zrok is software for sharing web services, files, and network resources. Prior to version 2.0.2, the zrok WebDAV drive backend (davServer.Dir) restricts path traversal through lexical normalization but does not prevent symlink following. When a symbolic link inside the shared DriveRoot points to a location outside that root, remote WebDAV consumers can read files and—on shares without OS-level permission restrictions—write or overwrite files anywhere on the host filesystem accessible to the zrok process. This issue has been patched in version 2.0.2.
CVSS scores
| Score | Version | Source | Vector |
|---|---|---|---|
| 8.7High | 3.1 | CVEProject cvelistV5 (CNA) (GitHub_M) | CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N |
Affected products
| Vendor | Product | Versions | Source |
|---|---|---|---|
| openziti | zrok | < 2.0.2 | CVEProject cvelistV5 (CNA) |
References and advisories
3- https://github.com/openziti/zrok/security/advisories/GHSA-74m3-9qvm-rp9h x_refsource_CONFIRM
- https://github.com/openziti/zrok/commit/459bcfc1e121decae1b1d11c37ad94e4ed5bbf2e x_refsource_MISC
- https://github.com/openziti/zrok/releases/tag/v2.0.2 x_refsource_MISC
Kolun on Telegram @kolunsec
Exploited CVEs, key news and a daily digest
Alerts for this product's next CVEsFollow the product to get new vulnerabilities on Telegram.
Details
- Published
- 2026-05-08
- Last updated
- 2026-05-08
- State
- Published
- Assigner (CNA)
- GitHub_M
Exploit prediction (EPSS)
0.33%
Probability of exploitation in 30 days
26.2%
Percentile (among all CVEs)
SSVC assessment (CISA)
- Automatable
- No
- Exploitation
- None
- Technical impact
- Total
Weaknesses (CWE)
- CWE-61UNIX Symbolic Link (Symlink) Following
- CWE-22Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')