Skip to content
OpenAdvisories

Package · Go

github.com/openziti/zrok

5 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

3 results · Clear filters · Feed

  • High 8.3
    CVE-2026-45576

    zrok copy writes attacker-controlled WebDAV paths outside the destination root

    zrok is software for sharing web services, files, and network resources. From 0.4.23 until 2.0.3, `zrok2 copy` stores attacker-controlled WebDAV or zrok drive paths such as /../outside.txt in the source inventory and passes them to FilesystemTarget.WriteStrea…

    openziti zrok github.com/openziti/zrok/v2 github.com/openziti/zrok Go
  • High 8.7
    CVE-2026-42275

    zrok: WebDAV drive backend follows symlinks outside DriveRoot, enabling host filesystem read/write

    zrok is software for sharing web services, files, and network resources. Prior to version 2.0.2, the zrok WebDAV drive backend (davServer.Dir) restricts path traversal through lexical normalization but does not prevent symlink following. When a symbolic link …

    openziti zrok github.com/openziti/zrok/v2 github.com/openziti/zrok Go
  • High 7.5
    CVE-2026-40303

    zrok allows unauthenticated DoS via unbounded memory allocation in striped session cookie parsing

    zrok is software for sharing web services, files, and network resources. Prior to version 2.0.1, endpoints.GetSessionCookie parses an attacker-supplied cookie chunk count and calls make([]string, count) with no upper bound before any token validation occurs. …

    openziti zrok github.com/openziti/zrok/v2 github.com/openziti/zrok Go