# CVE-2026-42275: OpenZiti zrok symlink following in WebDAV drive backend

Source: https://junglewise.ai/threats/cve-2026-42275-openziti-zrok-symlink-following-in-webdav-drive-backend  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-05-08. Updated: 2026-05-12  
License: CC BY 4.0 with a link back

CVE-2026-42275 · Severity: high · CVSS 8.7 · Published 2026-05-08

zrok is a tool used to share local services and files over the internet. A vulnerability in its WebDAV file-sharing component allows unauthorized users to read or overwrite sensitive files on the host computer if a shortcut (symbolic link) pointing outside the shared folder exists. This could lead to the theft of private data or the modification of critical system files, potentially allowing an attacker to gain full control over the host system.

Technologies: [github.com/openziti/zrok (Go)](https://junglewise.ai/threats/technologies/github-com-openziti-zrok), [github.com/openziti/zrok/v2 (Go)](https://junglewise.ai/threats/technologies/github-com-openziti-zrok-v2), [Netfoundry Zrok](https://junglewise.ai/threats/technologies/netfoundry-zrok), [OpenZiti Zrok](https://junglewise.ai/threats/technologies/zrok). Vendors: [Go](https://junglewise.ai/threats/vendors/go), [Netfoundry](https://junglewise.ai/threats/vendors/netfoundry), [OpenZiti](https://junglewise.ai/threats/vendors/openziti).

## Quick answers

**Is CVE-2026-42275 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-42275 being exploited in the wild.

**How severe is CVE-2026-42275?** High severity, with a CVSS score of 8.7, published 8 May 2026.

**Which products and versions are affected?** github.com/openziti/zrok (Go) <= 1.1.11, SEMVER:introduced=0, SEMVER:introduced=0,last_affected=1.1.11; github.com/openziti/zrok/v2 (Go) < 2.0.2, SEMVER:introduced=0,fixed=2.0.2; OpenZiti Zrok <= 1.1.11.

**Is there a fix for CVE-2026-42275?** Yes. github.com/openziti/zrok/v2 (Go): upgrade to 2.0.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-42275 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-42275?** Check whether you run github.com/openziti/zrok (Go), github.com/openziti/zrok/v2 (Go), Netfoundry Zrok or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- github.com/openziti/zrok/v2 (Go): upgrade to 2.0.2 or later

  ```sh
  go get github.com/openziti/zrok/v2@v2.0.2
  ```


## Technical details

The zrok WebDAV drive backend (davServer.Dir) fails to validate that symbolic links remain within the designated DriveRoot. While the application performs lexical normalization to prevent standard path traversal (e.g., '../'), it does not check the resolution of symlinks. If a symlink pointing to an external directory exists within the share, a remote attacker can issue WebDAV HTTP requests to access or overwrite files with the permissions of the zrok process. The PUT handler specifically uses O_RDWR|O_CREATE|O_TRUNC, enabling the overwriting of critical files like SSH authorized_keys. This vulnerability is patched in version 2.0.2.

## Affected products

- OpenZiti zrok <= 1.1.11
- OpenZiti zrok/v2 < 2.0.2

## Identifiers

- CVE-2026-42275
- GHSA-74m3-9qvm-rp9h
- GO-2026-5203

## Timeline

- 2026-04-21: disclosed: Initial disclosure to vendor
- 2026-04-25: advisory: GitHub Advisory published
- 2026-05-08: other: NVD published CVE-2026-42275

## References

- [https://api.github.com/users/bugbunny-research](https://api.github.com/users/bugbunny-research)
- [https://github.com/bugbunny-research](https://github.com/bugbunny-research)
- [https://api.github.com/users/bugbunny-research/gists%7B/gist_id%7D](https://api.github.com/users/bugbunny-research/gists%7B/gist_id%7D)
- [https://api.github.com/users/bugbunny-research/repos](https://api.github.com/users/bugbunny-research/repos)
- [https://avatars.githubusercontent.com/u/262839898?v=4](https://avatars.githubusercontent.com/u/262839898?v=4)
- [https://api.github.com/users/bugbunny-research/events%7B/privacy%7D](https://api.github.com/users/bugbunny-research/events%7B/privacy%7D)

## Related threats

- [openziti zrok path traversal in zrok2 copy](https://junglewise.ai/threats/cve-2026-45576-openziti-zrok-path-traversal-in-zrok2-copy)
- [OpenZiti zrok SSRF in Python SDK ProxyShare](https://junglewise.ai/threats/cve-2026-45568-openziti-zrok-ssrf-in-python-sdk-proxyshare)
- [zrok: Broken ownership check in DELETE /api/v2/unaccess allows non-admin to delete global frontend records](https://junglewise.ai/threats/cve-2026-40304-zrok-broken-ownership-check-in-delete-api-v2-unaccess-allows-non)
- [zrok: Unauthenticated DoS via unbounded memory allocation in striped session cookie parsing](https://junglewise.ai/threats/cve-2026-40303-zrok-unauthenticated-dos-via-unbounded-memory-allocation-in)
- [zrok: Reflected XSS in GitHub OAuth callback via unsanitized refreshInterval error rendering](https://junglewise.ai/threats/cve-2026-40302-zrok-reflected-xss-in-github-oauth-callback-via-unsanitized)