zrok’s WebDAV drive backend allowed symbolic links inside the configured DriveRoot to point outside that root. A remote WebDAV client can instruct the server to follow such links, causing the server to read any file on the host filesystem, and, if the zrok process has write access, to overwrite arbitrary files. This flaw facilitates unauthorized data exfiltration and file manipulation.

The vulnerability affects all openziti zrok releases prior to v2.0.2. The issue was patched in the v2.0.2 release, which removes the symlink following behavior. All earlier versions remain vulnerable until upgraded.

With a CVSS score of 8.7, the flaw is considered high severity. Exploitation requires only a remote WebDAV request, which can be sent by any client that can reach the zrok service. No EPSS score is provided, and the vulnerability is not listed in CISA KEV. Because the attacker can read arbitrary files and potentially overwrite sensitive system or configuration files if they run with sufficient privileges, the impact may extend to configuration tampering, data leakage, or the insertion of malicious binaries that could later be executed.