CVE-2026-42275

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2026-42275

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-42275.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2026-42275

Aliases

Published

2026-05-08T03:45:57.209Z

Modified

2026-07-08T08:15:15.373068155Z

Severity

8.7 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N CVSS Calculator

Summary

zrok: WebDAV drive backend follows symlinks outside DriveRoot, enabling host filesystem read/write

Details

zrok is software for sharing web services, files, and network resources. Prior to version 2.0.2, the zrok WebDAV drive backend (davServer.Dir) restricts path traversal through lexical normalization but does not prevent symlink following. When a symbolic link inside the shared DriveRoot points to a location outside that root, remote WebDAV consumers can read files and—on shares without OS-level permission restrictions—write or overwrite files anywhere on the host filesystem accessible to the zrok process. This issue has been patched in version 2.0.2.

Database specific

{
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/42xxx/CVE-2026-42275.json",
    "cwe_ids": [
        "CWE-22",
        "CWE-61"
    ],
    "cna_assigner": "GitHub_M"
}

References

Affected packages

Git / github.com/openziti/zrok

Affected ranges

Type

GIT

Repo

https://github.com/openziti/zrok

Events

Introduced

Fixed

44688f324a8264a6f7ef2c3203709f3cf35b2472

Fixed

459bcfc1e121decae1b1d11c37ad94e4ed5bbf2e

Database specific

{
    "cpe": "cpe:2.3:a:netfoundry:zrok:*:*:*:*:*:*:*:*",
    "source": [
        "CPE_RANGE",
        "REFERENCES"
    ],
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "2.0.2"
        }
    ]
}

Affected versions

v0.*

v0.2.0

v0.2.0.1

v0.2.0.2

v0.2.0.3

v0.2.0.4

v0.2.1

v0.2.10

v0.2.11

v0.2.12

v0.2.13

v0.2.14

v0.2.15

v0.2.16

v0.2.17

v0.2.18

v0.2.2

v0.2.3

v0.2.4

v0.2.5

v0.2.6

v0.2.7

v0.2.8

v0.2.9

v0.3.0

v0.3.0-rc1

v0.3.0-rc2

v0.3.0-rc3

v0.3.0-rc4

v0.3.0-rc5

v0.3.0-rc6

v0.3.1

v0.3.2

v0.3.4

v0.3.5

v0.3.5-rc1

v0.3.6

v0.4.0

v0.4.10

v0.4.11

v0.4.12

v0.4.13

v0.4.14

v0.4.15

v0.4.16

v0.4.17

v0.4.18

v0.4.19

v0.4.2

v0.4.20

v0.4.21

v0.4.22

v0.4.23

v0.4.24

v0.4.25

v0.4.26

v0.4.27

v0.4.28

v0.4.29

v0.4.3

v0.4.30

v0.4.31

v0.4.32

v0.4.33

v0.4.34

v0.4.35

v0.4.36

v0.4.37

v0.4.38

v0.4.39

v0.4.4

v0.4.40

v0.4.41

v0.4.42

v0.4.43

v0.4.44

v0.4.45

v0.4.46

v0.4.47

v0.4.48

v0.4.49

v0.4.5

v0.4.6

v0.4.7

v0.4.8

v0.4.9

v1.*

v1.0.0

v1.0.1

v1.0.2

v1.0.3

v1.0.4

v1.0.5

v1.0.6

v1.0.7

v1.0.8

v1.1.0

v1.1.1

v1.1.10

v1.1.11

v1.1.2

v1.1.3

v1.1.4

v1.1.5

v1.1.6

v1.1.7

v1.1.8

v2.*

v2.0.0

v2.0.0-rc5

v2.0.0-rc6

v2.0.0-rc7

v2.0.0-rc8

v2.0.0-rc9

v2.0.1

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-42275.json"