Vulnerabilities

TI-2026-33325 CVE-2026-45576 · GHSA-c656-jcx2-7pqj

zrok copy writes attacker-controlled WebDAV paths outside the destination root

LOW 37

zrok is software for sharing web services, files, and network resources.

CVSS 4.0HIGH 8.3 Network No auth User interaction EPSS 0.00496 Published 2026-07-16 Fixed in 2.0.3 CWE-22

TI-2026-33317 CVE-2026-45568 · GHSA-jh67-hwqw-m5r7

zrok Python ProxyShare can be used as an SSRF proxy through absolute URL paths

MEDIUM 50

zrok is software for sharing web services, files, and network resources.

CVSS 4.0CRITICAL 9.9 Network No auth No interaction EPSS 0.00544 Published 2026-07-16 Fixed in 2.0.3 CWE-22

TI-2026-41883 CVE-2026-58165 · GHSA-c883-vc4m-3vc9

OpenZiti - Privilege Escalation to Admin via Unauthorized Enrollment Creation

MEDIUM 40

OpenZiti through 2.0.0, fixed in commit 3027fdf, contains a privilege escalation vulnerability that allows authenticated non-admin identities with fine-grained enrollment management permissions to create enrollments for…

CVSS 4.0HIGH 8.7 Network Low privileges No interaction EPSS 0.0034 Published 2026-06-30 Fixed CWE-862

TI-2026-30586 CVE-2026-42275 · GHSA-74m3-9qvm-rp9h

zrok: WebDAV drive backend follows symlinks outside DriveRoot, enabling host filesystem read/write

MEDIUM 40

zrok is software for sharing web services, files, and network resources.

CVSS 3.1HIGH 8.7 Network No auth No interaction EPSS 0.0033 Published 2026-05-08 Fixed in 2.0.2 CWE-22

TI-2026-29082 CVE-2026-40304 · GHSA-3jpj-v3xr-5h6g

zrok's broken ownership check in DELETE /api/v2/unaccess allows non-admin to delete global frontend records

LOW 24

zrok is software for sharing web services, files, and network resources.

CVSS 3.1MEDIUM 5.3 Network Low privileges No interaction EPSS 0.00286 Published 2026-04-17 Fixed in 2.0.1 CWE-284

TI-2026-29081 CVE-2026-40303 · GHSA-cpf9-ph2j-ccr9

zrok allows unauthenticated DoS via unbounded memory allocation in striped session cookie parsing

LOW 39

zrok is software for sharing web services, files, and network resources.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00453 Published 2026-04-17 Fixed in 2.0.1 CWE-400

TI-2026-29080 CVE-2026-40302 · GHSA-4fxq-2x3x-6xqx

zrok has reflected XSS in GitHub OAuth callback via unsanitized refreshInterval error rendering

LOW 27

zrok is software for sharing web services, files, and network resources.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00209 Published 2026-04-17 Fixed in 2.0.1 CWE-116

TI-2025-20336 CVE-2025-27501

Server Side Request Forgery in Ziti Console

LOW 37

OpenZiti is a free and open source project focused on bringing zero trust to any application.

CVSS 3.1HIGH 8.6 Network No auth No interaction EPSS 0.00397 Published 2025-03-03 Fixed in 3.7.1 CWE-918

TI-2025-20335 CVE-2025-27500

Cross Site Scripting potential in Ziti Console

MEDIUM 43

OpenZiti is a free and open source project focused on bringing zero trust to any application.

CVSS 3.1HIGH 8.2 Network No auth No interaction EPSS 0.00283 Published 2025-03-03 Fixed in 3.7.1 CWE-79

Vulnerabilities

Filters