CVE-2026-42275

zrok is software for sharing web services, files, and network resources. Prior to version 2.0.2, the zrok WebDAV drive backend (davServer.Dir) restricts path traversal through lexical normalization but does not prevent symlink following. When a symbolic link inside the shared DriveRoot points to a location outside that root, remote WebDAV consumers can read files and—on shares without OS-level permission restrictions—write or overwrite files anywhere on the host filesystem accessible to the zrok process. This issue has been patched in version 2.0.2.

CVSS v3 8.7 HIGH

8.7^/10

CVSS v3 : HIGH

Vector :

Exploitability : 2.2 / Impact : 5.8

Attack Vector NETWORK

Attack Complexity HIGH

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact NONE

Scope CHANGED

References

Link	Resource
https://github.com/openziti/zrok/commit/459bcfc1e121decae1b1d11c37ad94e4ed5bbf2e	Patch
https://github.com/openziti/zrok/releases/tag/v2.0.2	Product Release Notes
https://github.com/openziti/zrok/security/advisories/GHSA-74m3-9qvm-rp9h	Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:netfoundry:zrok:*:*:*:*:*:*:*:*

History

26 Oct 2026, 20:10

Type	Values Removed	Values Added
Summary		(es) zrok es un software para compartir servicios web, archivos y recursos de red. Antes de la versión 2.0.2, el backend de unidad WebDAV de zrok (davServer.Dir) restringe el salto de ruta mediante normalización léxica, pero no evita el seguimiento de enlaces simbólicos. Cuando un enlace simbólico dentro del DriveRoot compartido apunta a una ubicación fuera de esa raíz, los consumidores remotos de WebDAV pueden leer archivos y -en recursos compartidos sin restricciones de permisos a nivel de sistema operativo- escribir o sobrescribir archivos en cualquier lugar del sistema de archivos del host accesible al proceso zrok. Este problema ha sido parcheado en la versión 2.0.2.

Information

Published : 2026-05-08 04:16

Updated : 2026-10-26 20:10

NVD link : CVE-2026-42275

Mitre link : CVE-2026-42275

CVE.ORG link : CVE-2026-42275

JSON object : View

Products Affected

netfoundry

zrok

CWE

CWE-22

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

CWE-61

UNIX Symbolic Link (Symlink) Following

{"id": "CVE-2026-42275", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-42275", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2026-05-08T12:13:14.913927Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 8.7, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.8, "exploitabilityScore": 2.2}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "openziti", "product": "zrok", "versions": [{"status": "affected", "version": "< 2.0.2"}]}]}], "published": "2026-05-08T04:16:22.823", "references": [{"url": "https://github.com/openziti/zrok/commit/459bcfc1e121decae1b1d11c37ad94e4ed5bbf2e", "tags": ["Patch"], "source": "security-advisories@github.com"}, {"url": "https://github.com/openziti/zrok/releases/tag/v2.0.2", "tags": ["Product", "Release Notes"], "source": "security-advisories@github.com"}, {"url": "https://github.com/openziti/zrok/security/advisories/GHSA-74m3-9qvm-rp9h", "tags": ["Vendor Advisory"], "source": "security-advisories@github.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-22"}, {"lang": "en", "value": "CWE-61"}]}], "descriptions": [{"lang": "en", "value": "zrok is software for sharing web services, files, and network resources. Prior to version 2.0.2, the zrok WebDAV drive backend (davServer.Dir) restricts path traversal through lexical normalization but does not prevent symlink following. When a symbolic link inside the shared DriveRoot points to a location outside that root, remote WebDAV consumers can read files and\u2014on shares without OS-level permission restrictions\u2014write or overwrite files anywhere on the host filesystem accessible to the zrok process. This issue has been patched in version 2.0.2."}, {"lang": "es", "value": "zrok es un software para compartir servicios web, archivos y recursos de red. Antes de la versi\u00f3n 2.0.2, el backend de unidad WebDAV de zrok (davServer.Dir) restringe el salto de ruta mediante normalizaci\u00f3n l\u00e9xica, pero no evita el seguimiento de enlaces simb\u00f3licos. Cuando un enlace simb\u00f3lico dentro del DriveRoot compartido apunta a una ubicaci\u00f3n fuera de esa ra\u00edz, los consumidores remotos de WebDAV pueden leer archivos y -en recursos compartidos sin restricciones de permisos a nivel de sistema operativo- escribir o sobrescribir archivos en cualquier lugar del sistema de archivos del host accesible al proceso zrok. Este problema ha sido parcheado en la versi\u00f3n 2.0.2."}], "lastModified": "2026-10-26T20:10:00.160", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:netfoundry:zrok:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "FC1325D6-16B3-4739-B913-E20275292B01", "versionEndExcluding": "2.0.2"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}