CVE-2026-42275

Katalog CVE

CVSS 8.7 · High EPSS 0,46%

Kerentanan Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') pada netfoundry zrok. Skor CVSS 3.1 8.7 (High) menurut github.com.

Deskripsi (NVD)

zrok is software for sharing web services, files, and network resources. Prior to version 2.0.2, the zrok WebDAV drive backend (davServer.Dir) restricts path traversal through lexical normalization but does not prevent symlink following. When a symbolic link inside the shared DriveRoot points to a location outside that root, remote WebDAV consumers can read files and—on shares without OS-level permission restrictions—write or overwrite files anywhere on the host filesystem accessible to the zrok process. This issue has been patched in version 2.0.2.

Rincian

Terbit di NVD

8 Mei 2026

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

8.7 (High), sumber github.com
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
CWE-61: UNIX Symbolic Link (Symlink) Following

EPSS (30 hari)

0,46% peluang dieksploitasi; lebih tinggi dari 38,0% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/openziti/zrok/security/advisories/GHSA-74m3-9qvm-rp9h advisory vendor
• https://github.com/openziti/zrok/commit/459bcfc1e121decae1b1d11c37ad94e4ed5bbf2e patch
• https://github.com/openziti/zrok/releases/tag/v2.0.2 product · release notes