Path traversal in zrok's `copy` command (CVE-2026-45576)

CVE-2026-45576 is a path traversal vulnerability in zrok's `copy` command. When copying from a WebDAV or zrok drive source, a malicious share operator can return a crafted DAV `href` (e.g., `/../outside.txt`) that causes `FilesystemTarget.WriteStream` to write files outside the intended destination directory. This allows a share operator to overwrite arbitrary files on the copying user's filesystem using that user's credentials. Affected versions: - >= 0.4.23, < 2.0.3 We recommend updating to: 2.0.3. CVSS 8.3 · our assessment: this_week Vendor advisory: https://github.com/openziti/zrok/security/advisories/GHSA-c656-jcx2-7pqj Details: https://vuln.today/cve/CVE-2026-45576