Executive brief
zrok is a tool used to share local services and files over the internet. A vulnerability in its WebDAV file-sharing component allows unauthorized users to read or overwrite sensitive files on the host computer if a shortcut (symbolic link) pointing outside the shared folder exists. This could lead to the theft of private data or the modification of critical system files, potentially allowing an attacker to gain full control over the host system.
Technical details
The zrok WebDAV drive backend (davServer.Dir) fails to validate that symbolic links remain within the designated DriveRoot. While the application performs lexical normalization to prevent standard path traversal (e.g., '../'), it does not check the resolution of symlinks. If a symlink pointing to an external directory exists within the share, a remote attacker can issue WebDAV HTTP requests to access or overwrite files with the permissions of the zrok process. The PUT handler specifically uses O_RDWR|O_CREATE|O_TRUNC, enabling the overwriting of critical files like SSH authorized_keys. This vulnerability is patched in version 2.0.2.
Affected products
- OpenZiti zrok <= 1.1.11
- OpenZiti zrok/v2 < 2.0.2
Timeline
- 2026-04-21: disclosed: Initial disclosure to vendor
- 2026-04-25: advisory: GitHub Advisory published
- 2026-05-08: other: NVD published CVE-2026-42275
References
- https://api.github.com/users/bugbunny-research
- https://github.com/bugbunny-research
- https://api.github.com/users/bugbunny-research/gists%7B/gist_id%7D
- https://api.github.com/users/bugbunny-research/repos
- https://avatars.githubusercontent.com/u/262839898?v=4
- https://api.github.com/users/bugbunny-research/events%7B/privacy%7D