CVE-2026-42275

{
  "id": "CVE-2026-42275",
  "sourceIdentifier": "[email protected]",
  "published": "2026-05-08T04:16:22.823",
  "lastModified": "2026-10-26T20:10:00.160",
  "vulnStatus": "Analyzed",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "zrok is software for sharing web services, files, and network resources. Prior to version 2.0.2, the zrok WebDAV drive backend (davServer.Dir) restricts path traversal through lexical normalization but does not prevent symlink following. When a symbolic link inside the shared DriveRoot points to a location outside that root, remote WebDAV consumers can read files and—on shares without OS-level permission restrictions—write or overwrite files anywhere on the host filesystem accessible to the zrok process. This issue has been patched in version 2.0.2."
    },
    {
      "lang": "es",
      "value": "zrok es un software para compartir servicios web, archivos y recursos de red. Antes de la versión 2.0.2, el backend de unidad WebDAV de zrok (davServer.Dir) restringe el salto de ruta mediante normalización léxica, pero no evita el seguimiento de enlaces simbólicos. Cuando un enlace simbólico dentro del DriveRoot compartido apunta a una ubicación fuera de esa raíz, los consumidores remotos de WebDAV pueden leer archivos y -en recursos compartidos sin restricciones de permisos a nivel de sistema operativo- escribir o sobrescribir archivos en cualquier lugar del sistema de archivos del host accesible al proceso zrok. Este problema ha sido parcheado en la versión 2.0.2."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "openziti",
          "product": "zrok",
          "versions": [
            {
              "version": "< 2.0.2",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "[email protected]",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N",
          "baseScore": 8.7,
          "baseSeverity": "HIGH",
          "attackVector": "NETWORK",
          "attackComplexity": "HIGH",
          "privilegesRequired": "NONE",
          "userInteraction": "NONE",
          "scope": "CHANGED",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "availabilityImpact": "NONE"
        },
        "exploitabilityScore": 2.2,
        "impactScore": 5.8
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-05-08T12:13:14.913927Z",
          "id": "CVE-2026-42275",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "[email protected]",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-22"
        },
        {
          "lang": "en",
          "value": "CWE-61"
        }
      ]
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "operator": "OR",
          "negate": false,
          "cpeMatch": [
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:netfoundry:zrok:*:*:*:*:*:*:*:*",
              "versionEndExcluding": "2.0.2",
              "matchCriteriaId": "FC1325D6-16B3-4739-B913-E20275292B01"
            }
          ]
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://github.com/openziti/zrok/commit/459bcfc1e121decae1b1d11c37ad94e4ed5bbf2e",
      "source": "[email protected]",
      "tags": [
        "Patch"
      ]
    },
    {
      "url": "https://github.com/openziti/zrok/releases/tag/v2.0.2",
      "source": "[email protected]",
      "tags": [
        "Product",
        "Release Notes"
      ]
    },
    {
      "url": "https://github.com/openziti/zrok/security/advisories/GHSA-74m3-9qvm-rp9h",
      "source": "[email protected]",
      "tags": [
        "Vendor Advisory"
      ]
    }
  ]
}