TI-2026-30586 Aliases CVE-2026-42275 GHSA-74m3-9qvm-rp9h

zrok: WebDAV drive backend follows symlinks outside DriveRoot, enabling host filesystem read/write

MEDIUM 40CWE-22Published 2026-05-08 · Updated 2026-05-08

Key facts

Attack vector: Network
Privileges required: None
User interaction: None
Attack complexity: High
Impact type: —
Confidentiality · integrity · availability: High · High · None
Fix status: Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub.

Summary

zrok is software for sharing web services, files, and network resources. Prior to version 2.0.2, the zrok WebDAV drive backend (davServer.Dir) restricts path traversal through lexical normalization but does not prevent symlink following. When a symbolic link inside the shared DriveRoot points to a location outside that root, remote WebDAV consumers can read files and—on shares without OS-level permission restrictions—write or overwrite files anywhere on the host filesystem accessible to the zrok process. This issue has been patched in version 2.0.2.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.0033 26th percentileScored 2026-11-07

Fix Fixed zrok (openziti): 2.0.2github.com/openziti/zrok/v2 (Go): 2.0.2

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
openziti	zrok	before 2.0.2	2.0.2	Patch available	CNA
—	github.com/openziti/zrok (Go)	up to 1.1.11	—	No fix listed	GHSA-74m3-9qvm-rp9h
—	github.com/openziti/zrok/v2 (Go)	before 2.0.2	2.0.2	Patch available	GHSA-74m3-9qvm-rp9h

zrok Vendoropenziti Affected before 2.0.2 Fixed in 2.0.2 Patch available CNA
github.com/openziti/zrok (Go) Vendor— Affected up to 1.1.11 Fixed in — No fix listed GHSA-74m3-9qvm-rp9h
github.com/openziti/zrok/v2 (Go) Vendor— Affected before 2.0.2 Fixed in 2.0.2 Patch available GHSA-74m3-9qvm-rp9h

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:netfoundry:zrok::::::::	before 2.0.2	Vulnerable	Netfoundry

cpe:2.3:a:netfoundry:zrok:*:*:*:*:*:*:*:* Versions before 2.0.2 Vulnerable ·Netfoundry

Remediation

Fix · CNA zrok (openziti) Fixed in 2.0.2
Fix · GHSA-74m3-9qvm-rp9h github.com/openziti/zrok/v2 (Go) Fixed in 2.0.2 Advisory →

Timeline

2026-10-02 Threatist record created from CVE-2026-42275
2026-10-03 Alias added: GHSA-74m3-9qvm-rp9h

References

Patch 1

https://github.com/openziti/zrok/commit/459bcfc1e121decae1b1d11c37ad94e4ed5bbf2e

Advisory 2

Other 2

TI-2026-33317 zrok Python ProxyShare can be used as an SSRF proxy through absolute URL paths CVSS 4.0CRITICAL 9.9
TI-2025-20335 Cross Site Scripting potential in Ziti Console CVSS 3.1HIGH 8.2
TI-2026-41883 OpenZiti - Privilege Escalation to Admin via Unauthorized Enrollment Creation CVSS 4.0HIGH 8.7
TI-2026-29081 zrok allows unauthenticated DoS via unbounded memory allocation in striped session cookie parsing CVSS 3.1HIGH 7.5
TI-2026-33325 zrok copy writes attacker-controlled WebDAV paths outside the destination root CVSS 4.0HIGH 8.3
TI-2025-20336 Server Side Request Forgery in Ziti Console CVSS 3.1HIGH 8.6

See all 8 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences