VulnerabilityAnalyzed

CVE-2026-42275

Prior to version 2.0.2, the zrok WebDAV drive backend (davServer.Dir) restricts path traversal through lexical normalization but does not prevent symlink following.

HIGH 8.7EPSS 0.33%

Does this matter?

High impact if exploited, but EPSS currently rates exploitation as unlikely (0.33%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.

Description

zrok is software for sharing web services, files, and network resources. Prior to version 2.0.2, the zrok WebDAV drive backend (davServer.Dir) restricts path traversal through lexical normalization but does not prevent symlink following. When a symbolic link inside the shared DriveRoot points to a location outside that root, remote WebDAV consumers can read files and—on shares without OS-level permission restrictions—write or overwrite files anywhere on the host filesystem accessible to the zrok process. This issue has been patched in version 2.0.2.

CVSS 3.1: 8.7 HIGHCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N
EPSS: 0.33% probability · 26th percentile
CISA KEV: Not listed
Weakness: CWE-22, CWE-61
Affected: netfoundry/zrok
Source: security-advisories@github.com

References

https://github.com/openziti/zrok/commit/459bcfc1e121decae1b1d11c37ad94e4ed5bbf2ePatch
https://github.com/openziti/zrok/releases/tag/v2.0.2Product, Release Notes
https://github.com/openziti/zrok/security/advisories/GHSA-74m3-9qvm-rp9hVendor Advisory

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.