CVE-2026-45576

zrok copy writes attacker-controlled WebDAV paths outside the destination root

Published Jul 16, 2026 CVSS 4.0 · 8.3 High EPSS < 1% KEV · Not listed

Description

zrok is software for sharing web services, files, and network resources. From 0.4.23 until 2.0.3, `zrok2 copy` stores attacker-controlled WebDAV or zrok drive paths such as /../outside.txt in the source inventory and passes them to FilesystemTarget.WriteStream, allowing the sync pipeline to write files outside the selected local filesystem destination root. This issue is fixed in version 2.0.3.

Analysis

Technical impact

The vulnerability exists in the zrok2 copy command, which accepts user‑specified WebDAV or zrok drive paths. From versions 0.4.23 through 2.0.3, the command stores attacker‑controlled paths such as /../outside.txt in its source inventory and forwards them to FilesystemTarget.WriteStream. This causes the sync pipeline to write files outside the chosen local filesystem destination root, allowing an attacker to create or overwrite arbitrary files where the zrok process has write permission. The flaw is a directory traversal weakness classified as CWE‑22.

Affected Systems

OpenZiti includes all zrok clients from version 0.4.23 up through but not including 2.0.3. Any system running those releases, regardless of operating system, is susceptible to the flaw until the user applies the 2.0.3 release or later.

Risk and Exploitability

The CVSS score of 8.3 indicates high severity; the EPSS of <1% suggests a low exposure rate. The vulnerability is not included in KEV. Attackers with the ability to invoke zrok2 copy and supply crafted paths can write arbitrary files, potentially corrupting configuration or inserting malware wherever the process can write, if the host filesystem allows it.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

openziti

zrok

affected

Version	Status	Constraints
`>= 0.4.23, < 2.0.3`	affected	—

Configuration 1 [-]

cpe:2.3:a:netfoundry:zrok:*:*:*:*:*:*:*:*

No data.

Vendor Product Versions

Openziti

Zrok

Version	Status	Scheme	Platform
`[0.4.23,2.0.3)`	affected	semver	—

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Upgrade zrok to v2.0.3 or later, where the sanitization of attacker‑controlled paths mitigates the CWE‑22 directory traversal weakness.
If an update is not immediately possible, configure the zrok2 copy command to accept only validated paths, rejecting those containing ". ." or absolute references, thereby enforcing strict path validation to counter CWE‑22.
Run the zrok process with the minimum privileges required, ensuring it cannot write to sensitive directories that could be targeted by a directory traversal, which mitigates CWE‑22.

Generated by OpenCVE AI on July 31, 2026 at 01:39 UTC.

Tracking

Advisories

Source	ID	Title
Github GHSA	GHSA-c656-jcx2-7pqj	zrok copy writes attacker-controlled WebDAV paths outside the destination root

Metrics

Attack Vector Network

Attack Complexity Low

Privileges Required None

Attack Requirements None

User Interaction Active

Vulnerable System Confidentiality Impact None

Vulnerable System Integrity Impact High

Vulnerable System Availability Impact None

Subsequent System Confidentiality Impact High

Subsequent System Integrity Impact High

Subsequent System Availability Impact None

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact None

Integrity Impact High

Availability Impact None

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.496% probability within 30 days)

Exploitation none

Automatable no

Technical Impact partial

References

Link	Providers
https://github.com/openziti/zrok/commit/a5811e61589d2f804267c6de4a9056db1bdea457
https://github.com/openziti/zrok/releases/tag/v2.0.3
https://github.com/openziti/zrok/security/advisories/GHSA-c656-jcx2-7pqj

History

Jul 16, 2026 7:15 PM First appearance in the feed. Affected vendors updated View changes

Type	Values Removed	Values Added
First Time appeared		Openziti Openziti zrok
Vendors & Products		Openziti Openziti zrok

Jul 16, 2026 6:30 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Jul 16, 2026 5:00 PM Description updated. Title updated. Weaknesses updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Description		zrok is software for sharing web services, files, and network resources. From 0.4.23 until 2.0.3, `zrok2 copy` stores attacker-controlled WebDAV or zrok drive paths such as /../outside.txt in the source inventory and passes them to FilesystemTarget.WriteStream, allowing the sync pipeline to write files outside the selected local filesystem destination root. This issue is fixed in version 2.0.3.
Title		zrok copy writes attacker-controlled WebDAV paths outside the destination root
Weaknesses		CWE-22
References		https://github.com/openziti/zrok/commit/a5811e61589d2f804267c6de4a9056db1bdea457 https://github.com/openziti/zrok/releases/tag/v2.0.3 https://github.com/openziti/zrok/security/advisories/GHSA-c656-jcx2-7pqj
Metrics		cvssV4_0 `{'score': 8.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:H/VA:N/SC:H/SI:H/SA:N'}`