Vulnerability Description
zrok is software for sharing web services, files, and network resources. From 0.4.23 until 2.0.3, `zrok2 copy` stores attacker-controlled WebDAV or zrok drive paths such as /../outside.txt in the source inventory and passes them to FilesystemTarget.WriteStream, allowing the sync pipeline to write files outside the selected local filesystem destination root. This issue is fixed in version 2.0.3.
CVSS Score
HIGH
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Netfoundry | Zrok | >= 0.4.23, < 2.0.3 |
Related Weaknesses (CWE)
References
- https://github.com/openziti/zrok/commit/a5811e61589d2f804267c6de4a9056db1bdea457Patch
- https://github.com/openziti/zrok/releases/tag/v2.0.3Release Notes
- https://github.com/openziti/zrok/security/advisories/GHSA-c656-jcx2-7pqjVendor Advisory
FAQ
What is CVE-2026-45576?
CVE-2026-45576 is a vulnerability with a CVSS score of 7.5 (HIGH). zrok is software for sharing web services, files, and network resources. From 0.4.23 until 2.0.3, `zrok2 copy` stores attacker-controlled WebDAV or zrok drive paths such as /../outside.txt in the sour...
How severe is CVE-2026-45576?
CVE-2026-45576 has been rated HIGH with a CVSS base score of 7.5/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2026-45576?
Check the references section above for vendor advisories and patch information. Affected products include: Netfoundry Zrok.