EUVD-2026-28511
GHSA-74m3-9qvm-rp9h
CVSS VectorNVD
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N
Lifecycle Timeline
4DescriptionNVD
zrok is software for sharing web services, files, and network resources. Prior to version 2.0.2, the zrok WebDAV drive backend (davServer.Dir) restricts path traversal through lexical normalization but does not prevent symlink following. When a symbolic link inside the shared DriveRoot points to a location outside that root, remote WebDAV consumers can read files and-on shares without OS-level permission restrictions-write or overwrite files anywhere on the host filesystem accessible to the zrok process. This issue has been patched in version 2.0.2.
AnalysisAI
Remote path traversal via symlink following in zrok's WebDAV drive backend allows unauthenticated network attackers to read arbitrary files accessible to the zrok process and overwrite critical system files (such as SSH authorized_keys) outside the intended share boundary. Attack complexity is high because exploitation requires a pre-existing symlink inside the shared directory pointing outside DriveRoot-a precondition typically created through local access or misconfiguration, not by the attacker. …
Sign in for full analysis, threat intelligence, and remediation guidance.
RemediationAI
Within 24 hours: inventory all zrok deployments and identify instances running WebDAV drive backend functionality. Within 7 days: upgrade zrok to version 2.0.2 or later (specifically incorporating commit 459bcfc1e121decae1b1d11c37ac94e4ed5bbf2e); audit shared directories for unexpected symlinks pointing outside DriveRoot. …
Sign in for detailed remediation steps.
Share
External POC / Exploit Code
Leaving vuln.today