CVE-2026-42275 - Vulnerability Analysis

Overview

zrok < 2.0.2 contains a path traversal caused by symlink following in the WebDAV drive backend, letting remote WebDAV consumers read and write files outside the shared root, exploit requires no special privileges.

Severity & Score

Impact

Remote attackers can read and write arbitrary files on the host filesystem accessible to the zrok process, risking data compromise and system integrity.

Mitigation

Update to version 2.0.2 or later.

References

• https://github.com/openziti/zrok/commit/459bcfc1e121decae1b1d11c37ad94e4ed5bbf2e
• https://github.com/openziti/zrok/releases/tag/v2.0.2
• https://github.com/openziti/zrok/security/advisories/GHSA-74m3-9qvm-rp9h

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner