CVE-2026-45576 — Vulnerability in github.com/openziti/zrok/v2 —...

HIGH

zrok copy writes attacker-controlled WebDAV paths outside the destination root

Published May 19, 2026Updated June 25, 2026Source: osv

Summary

## Summary Alice runs `zrok2 copy` from a WebDAV or zrok drive controlled by Bob into a local filesystem target. Bob returns a DAV `href` such as `/../outside.txt`. The sync pipeline stores that path in the source inventory and passes it to `FilesystemTarget.WriteStream`, which joins it with the target root and creates the file outside Alice's selected directory. ### Impact Users given access to a zrok share may be able to traverse the directory tree arbitrarily with the sharing users credentials, allowing for sensitive information to be overwritten.

Advisory Timeline

First published May 19, 2026 (146 days ago).
Last revised June 25, 2026 — 37 days after initial publication.

Remediation

Upgrade to the fixed version using your package manager.

Update github.com/openziti/zrok/v2 to 2.0.3 or later

go get github.com/openziti/zrok/v2@v2.0.3

After upgrading, run your dependency scanner again to confirm the vulnerability is resolved.

Affected Packages (2)

Affects 1 ecosystem: go (2).

Package	Ecosystem	Affected	Fixed In
github.com/openziti/zrok/v2	go	All versions	2.0.3
github.com/openziti/zrok	go	All versions	Range-based data available

Vulnerability Classification

Common Weakness Enumeration (CWE) identifiers for this vulnerability type.

CWE-22
Path TraversalMITRE

CVSS Score Breakdown

What the CVSS (Common Vulnerability Scoring System) 8.8 score means for each attack dimension.

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Scope

—

Confidentiality

—

Integrity

—

Availability

—

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:H/VA:N/SC:H/SI:H/SA:N

References

Frequently Asked Questions

What is CVE-2026-45576?: zrok copy writes attacker-controlled WebDAV paths outside the destination root This vulnerability has been assigned a severity rating of HIGH (CVSS score: 8.8/10).
How do I check if my project is affected by CVE-2026-45576?: CVE-2026-45576 affects github.com/openziti/zrok/v2 and github.com/openziti/zrok. Use GeekWala's free vulnerability scanner to check your dependencies against CVE-2026-45576 and 200,000+ other known vulnerabilities.

Severity & Exploitability

CVSS Score

8.8

High exploitability or significant impact. Prioritize remediation within days.

Also Known As

GHSA-c656-jcx2-7pqj

GO-2026-5315

Related CVEs

CVE-2026-107809
HIGH
Nginx-UI AuthRequired token cookie fallback enables CSRF against management APIs
CVE-2026-42275
HIGH
zrok: WebDAV drive backend follows symlinks outside DriveRoot, enabling host filesystem read/write
CVE-2026-107813
HIGH
Nginx UI: Incomplete fix of CVE-2026-84315 - the api/cluster router was not - wrapped in RequireSecureSession, so those sensitive mutations run without OTP step-up

More Go Modules advisories

Check if you're affected

Scan your dependencies to see if this vulnerability affects your projects.

Scan Your Dependencies