CVE-2026-42275CWE-22CWE-61

zrok: WebDAV drive backend follows symlinks outside DriveRoot, enabling host filesystem read/write

High · published May 8, 2026

CVSS v3.1
8.7
EPSS
0%
Percentile
38.8
In the wild
Unconfirmed
What it is

zrok is software for sharing web services, files, and network resources. Prior to version 2.0.2, the zrok WebDAV drive backend (davServer.Dir) restricts path traversal through lexical normalization but does not prevent symlink following. When a symbolic link inside the shared DriveRoot points to a location outside that root, remote WebDAV consumers can read files and—on shares without OS-level permission restrictions—write or overwrite files anywhere on the host filesystem accessible to the zrok process. This issue has been patched in version 2.0.2.

The record
Technical detail
CVSS v3.1
8.7 · HIGH
Vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N
CVSS v4.0
Not supplied
EPSS
0.00460 · 38.8th percentile
Weaknesses
CWE-22 · Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'); CWE-61 · UNIX Symbolic Link (Symlink) Following
Published
2026-05-08T03:45Z
EPSS history
Timeline
  • 08 MAY 03:45Z
    zrok: WebDAV drive backend follows symlinks outside DriveRoot, enabling host filesystem read/write
    cvelistv5