CVE-2026-45576

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-45576
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-45576.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-45576
Aliases
Published
2026-07-16T16:45:52.766Z
Modified
2026-07-18T03:47:22.730323156Z
Severity
  • 8.3 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:H/VA:N/SC:H/SI:H/SA:N CVSS Calculator
Summary
zrok copy writes attacker-controlled WebDAV paths outside the destination root
Details

zrok is software for sharing web services, files, and network resources. From 0.4.23 until 2.0.3, zrok2 copy stores attacker-controlled WebDAV or zrok drive paths such as /../outside.txt in the source inventory and passes them to FilesystemTarget.WriteStream, allowing the sync pipeline to write files outside the selected local filesystem destination root. This issue is fixed in version 2.0.3.

Database specific 
{
    "cwe_ids": [
        "CWE-22"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/45xxx/CVE-2026-45576.json",
    "cna_assigner": "GitHub_M"
}
References

Affected packages

Git / github.com/openziti/zrok

Affected ranges

Type
GIT
Repo
https://github.com/openziti/zrok
Events
Introduced
8d88e32d910986d49b576972d590398a6eb9a2cb
Fixed
a5811e61589d2f804267c6de4a9056db1bdea457
Fixed
01695e8ac32d5a3f35457a9f87ace076448e6917
Database specific 
{
    "extracted_events": [
        {
            "introduced": "0.4.23"
        },
        {
            "fixed": "2.0.3"
        }
    ],
    "source": [
        "AFFECTED_FIELD",
        "REFERENCES"
    ]
}

Affected versions

v0.*
v0.4.23
v0.4.24
v0.4.25
v0.4.26
v0.4.27
v0.4.28
v0.4.29
v0.4.30
v0.4.31
v0.4.32
v0.4.33
v0.4.34
v0.4.35
v0.4.36
v0.4.37
v0.4.38
v0.4.39
v0.4.40
v0.4.41
v0.4.42
v0.4.43
v0.4.44
v0.4.45
v0.4.46
v0.4.47
v0.4.48
v0.4.49
v1.*
v1.0.0
v1.0.1
v1.0.2
v1.0.3
v1.0.4
v1.0.5
v1.0.6
v1.0.7
v1.0.8
v1.1.0
v1.1.1
v1.1.10
v1.1.11
v1.1.2
v1.1.3
v1.1.4
v1.1.5
v1.1.6
v1.1.7
v1.1.8
v2.*
v2.0.0
v2.0.0-rc5
v2.0.0-rc6
v2.0.0-rc7
v2.0.0-rc8
v2.0.0-rc9
v2.0.1
v2.0.2

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-45576.json"