CVE-2026-45576

zrok is software for sharing web services, files, and network resources. From 0.4.23 until 2.0.3, `zrok2 copy` stores attacker-controlled WebDAV or zrok drive paths such as /../outside.txt in the source inventory and passes them to FilesystemTarget.WriteStream, allowing the sync pipeline to write files outside the selected local filesystem destination root. This issue is fixed in version 2.0.3.

CVSS v3 7.5 HIGH

7.5^/10

CVSS v3 : HIGH

Vector :

Exploitability : 3.9 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact HIGH

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://github.com/openziti/zrok/commit/a5811e61589d2f804267c6de4a9056db1bdea457	Patch
https://github.com/openziti/zrok/releases/tag/v2.0.3	Release Notes
https://github.com/openziti/zrok/security/advisories/GHSA-c656-jcx2-7pqj	Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:netfoundry:zrok:*:*:*:*:*:*:*:*

History

24 Oct 2026, 20:10

Type	Values Removed	Values Added
Summary		(es) zrok es un software para compartir servicios web, archivos y recursos de red. Desde la versión 0.4.23 hasta la 2.0.3, el comando ’zrok2 copy’ almacena rutas de unidades WebDAV o zrok controladas por el atacante, como /.. / outside.txt, en el inventario de origen y las pasa a FilesystemTarget.WriteStream, permitiendo que la canalización de sincronización escriba archivos fuera de la raíz de destino del sistema de archivos local seleccionada. Este problema se ha solucionado en la versión 2.0.3.

Information

Published : 2026-07-16 17:16

Updated : 2026-10-24 20:10

NVD link : CVE-2026-45576

Mitre link : CVE-2026-45576

CVE.ORG link : CVE-2026-45576

JSON object : View

Products Affected

netfoundry

zrok

CWE

CWE-22

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

{"id": "CVE-2026-45576", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-45576", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-07-16T17:06:49.972811Z"}}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 3.9}], "cvssMetricV40": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 8.3, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "HIGH", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:H/VA:N/SC:H/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "ACTIVE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "HIGH", "vulnConfidentialityImpact": "NONE", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "openziti", "product": "zrok", "versions": [{"status": "affected", "version": ">= 0.4.23, < 2.0.3"}]}]}], "published": "2026-07-16T17:16:56.567", "references": [{"url": "https://github.com/openziti/zrok/commit/a5811e61589d2f804267c6de4a9056db1bdea457", "tags": ["Patch"], "source": "security-advisories@github.com"}, {"url": "https://github.com/openziti/zrok/releases/tag/v2.0.3", "tags": ["Release Notes"], "source": "security-advisories@github.com"}, {"url": "https://github.com/openziti/zrok/security/advisories/GHSA-c656-jcx2-7pqj", "tags": ["Vendor Advisory"], "source": "security-advisories@github.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-22"}]}], "descriptions": [{"lang": "en", "value": "zrok is software for sharing web services, files, and network resources. From 0.4.23 until 2.0.3, `zrok2 copy` stores attacker-controlled WebDAV or zrok drive paths such as /../outside.txt in the source inventory and passes them to FilesystemTarget.WriteStream, allowing the sync pipeline to write files outside the selected local filesystem destination root. This issue is fixed in version 2.0.3."}, {"lang": "es", "value": "zrok es un software para compartir servicios web, archivos y recursos de red. Desde la versi\u00f3n 0.4.23 hasta la 2.0.3, el comando \u2019zrok2 copy\u2019 almacena rutas de unidades WebDAV o zrok controladas por el atacante, como /.. / outside.txt, en el inventario de origen y las pasa a FilesystemTarget.WriteStream, permitiendo que la canalizaci\u00f3n de sincronizaci\u00f3n escriba archivos fuera de la ra\u00edz de destino del sistema de archivos local seleccionada. Este problema se ha solucionado en la versi\u00f3n 2.0.3."}], "lastModified": "2026-10-24T20:10:00.137", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:netfoundry:zrok:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "090FE6C1-CB2B-47FF-8030-868232D358DA", "versionEndExcluding": "2.0.3", "versionStartIncluding": "0.4.23"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}