CVE-2026-45568CWE-22

zrok Python ProxyShare can be used as an SSRF proxy through absolute URL paths

Critical · published July 16, 2026

CVSS v4.0
9.9
EPSS
1%
Percentile
44.9
In the wild
Unconfirmed
What it is

zrok is software for sharing web services, files, and network resources. Prior to 2.0.3, zrok's Python SDK ProxyShare Flask proxy route accepts an absolute URL in the request path and passes it to urllib.parse.urljoin, allowing the requested path to replace the configured target host and causing requests.request to return a server-side response from an attacker-chosen URL. This issue is fixed in version 2.0.3.

The record
Technical detail
CVSS v4.0
9.9 · CRITICAL
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:H/SI:H/SA:L
EPSS
0.00544 · 44.9th percentile
Weakness
CWE-22 · Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Published
2026-07-16T16:45Z
EPSS history
Timeline
  • 16 JUL 16:45Z
    zrok Python ProxyShare can be used as an SSRF proxy through absolute URL paths
    cvelistv5