CVE-2026-42275: OpenZiti zrok symlink following in WebDAV drive backend

CVE-2026-42275 · Severity: high · CVSS 8.7 · Published 2026-05-08

zrok is a tool used to share local services and files over the internet. A vulnerability in its WebDAV file-sharing component allows unauthorized users to read or overwrite sensitive files on the host computer if a shortcut (symbolic link) pointing outside the shared folder exists. This could lead to the theft of private data or the modification of critical system files, potentially allowing an attacker to gain full control over the host system.

Technologies: github.com/openziti/zrok (Go), github.com/openziti/zrok/v2 (Go), Netfoundry Zrok, OpenZiti Zrok. Vendors: Go, Netfoundry, OpenZiti.

Quick answers

Is CVE-2026-42275 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-42275 being exploited in the wild.
How severe is CVE-2026-42275?
High severity, with a CVSS score of 8.7, published 8 May 2026.
Which products and versions are affected?
github.com/openziti/zrok (Go) <= 1.1.11, SEMVER:introduced=0, SEMVER:introduced=0,last_affected=1.1.11; github.com/openziti/zrok/v2 (Go) < 2.0.2, SEMVER:introduced=0,fixed=2.0.2; OpenZiti Zrok <= 1.1.11.
Is there a fix for CVE-2026-42275?
Yes. github.com/openziti/zrok/v2 (Go): upgrade to 2.0.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-42275 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-42275?
Check whether you run github.com/openziti/zrok (Go), github.com/openziti/zrok/v2 (Go), Netfoundry Zrok or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • github.com/openziti/zrok/v2 (Go): upgrade to 2.0.2 or later
    go get github.com/openziti/zrok/v2@v2.0.2

Technical details

The zrok WebDAV drive backend (davServer.Dir) fails to validate that symbolic links remain within the designated DriveRoot. While the application performs lexical normalization to prevent standard path traversal (e.g., '../'), it does not check the resolution of symlinks. If a symlink pointing to an external directory exists within the share, a remote attacker can issue WebDAV HTTP requests to access or overwrite files with the permissions of the zrok process. The PUT handler specifically uses O_RDWR|O_CREATE|O_TRUNC, enabling the overwriting of critical files like SSH authorized_keys. This vulnerability is patched in version 2.0.2.

Affected products

  • OpenZiti zrok <= 1.1.11
  • OpenZiti zrok/v2 < 2.0.2

Identifiers

  • CVE-2026-42275
  • GHSA-74m3-9qvm-rp9h
  • GO-2026-5203

Timeline

  • 2026-04-21: disclosed: Initial disclosure to vendor
  • 2026-04-25: advisory: GitHub Advisory published
  • 2026-05-08: other: NVD published CVE-2026-42275

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.