PT-2026-37189 · Zrok · Zrok

Published 2026-04-25 · Updated 2026-05-09 · CVE-2026-42275

Positive Technologies (AI Summary)

CVSS v3.1

8.7

High

Base vector

AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions zrok versions prior to 2.0.2

Description The zrok WebDAV drive backend davServer.Dir restricts path traversal through lexical normalization but fails to prevent symlink following. If a symbolic link within the shared DriveRoot points to a location outside that root, remote WebDAV consumers can read files. On shares lacking OS-level permission restrictions, attackers can also write to or overwrite files anywhere on the host filesystem accessible to the zrok process. This occurs because the WebDAV PUT handler opens files with O RDWR|O CREATE|O TRUNC. The issue affects the Dir.OpenFile(), Dir.Stat(), Dir.Mkdir(), and Dir.RemoveAll() functions in drives/davServer/file.go, as well as NewBackend() in endpoints/drive/backend.go.

Recommendations Update to version 2.0.2.

Fix

Path traversal

Weakness Enumeration

CWE-22

CWE-61

Related Identifiers

CVE-2026-42275

GHSA-74M3-9QVM-RP9H

Affected Products

Zrok

References · 9

• https://github.com/openziti/zrok/commit/459bcfc1e121decae1b1d11c37ad94e4ed5bbf2e · Patch
• https://github.com/openziti/zrok/security/advisories/GHSA-74m3-9qvm-rp9h · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-42275 · Security Note
• https://osv.dev/vulnerability/GHSA-74m3-9qvm-rp9h · Vendor Advisory
• https://github.com/openziti/zrok · Note
• https://github.com/openziti/zrok/releases/tag/v2.0.2 · Note
• https://t.me/cveNotify/162742 · Telegram Post
• https://twitter.com/CVEnew/status/2053174704484040813 · Twitter Post
• https://t.me/CVEtracker/53078 · Telegram Post