PT-2026-41960 · Go · Github.Com/Openziti/Zrok+1

Publicado 2026-05-19 · Atualizado 2026-05-19 · CVE-2026-45576

OSV

CVSS v4.0

8.3

Alta

Vetor base

AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:H/VA:N/SC:H/SI:H/SA:N

Summary

Alice runs zrok2 copy from a WebDAV or zrok drive controlled by Bob into a local filesystem target. Bob returns a DAV href such as /../outside.txt. The sync pipeline stores that path in the source inventory and passes it to FilesystemTarget.WriteStream, which joins it with the target root and creates the file outside Alice's selected directory.

Impact

Users given access to a zrok share may be able to traverse the directory tree arbitrarily with the sharing users credentials, allowing for sensitive information to be overwritten.

Correção

Path traversal

Enumeração de Fraquezas

CWE-22

Identificadores relacionados

CVE-2026-45576

GHSA-C656-JCX2-7PQJ

Produtos afetados

Github.Com/Openziti/Zrok

Github.Com/Openziti/Zrok/V2

Referências · 3

• https://github.com/openziti/zrok · Nota
• https://github.com/openziti/zrok/security/advisories/GHSA-c656-jcx2-7pqj · Nota
• https://osv.dev/vulnerability/GHSA-c656-jcx2-7pqj · Aviso do Fabricante