8.7

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-42275

CVE-2026-42275: zrok: WebDAV drive backend follows symlinks outside DriveRoot, enabling host filesystem read/write

Summary The zrok WebDAV drive backend (davServer.Dir) restricts path traversal through lexical normalization but does not prevent symlink following. When a symbolic link inside the shared DriveRoot points to a location outside that root, remote WebDAV consumers can read files and—on shares without OS-level permission restrictions—write or overwrite files anywhere on the host filesystem accessible to the zrok process.

Attack Vector: Network — exploitation is performed entirely over the WebDAV endpoint; the attacker issues HTTP requests to the public zrok share URL.
Attack Complexity: High — a precondition outside the attacker's direct control must hold: a symlink pointing outside DriveRoot must already exist within it (created locally, not via WebDAV).
Privileges Required: None — zrok share public --backend-mode drive exposes the WebDAV endpoint with no authentication by default.
User Interaction: None — once the symlink precondition is met, exploitation requires no user interaction.
Scope: Changed — the vulnerability allows an attacker to escape the WebDAV root (the security boundary) and access the broader host filesystem.
Confidentiality Impact: High — arbitrary files readable by the zrok process can be retrieved.
Integrity Impact: High — the WebDAV PUT handler opens files with O_RDWR|O_CREATE|O_TRUNC, meaning symlink targets outside DriveRoot can be overwritten (e.g. ~/.ssh/authorized_keys).
Availability Impact: None — no direct availability impact.

Affected Components

drives/davServer/file.go — Dir.OpenFile (line 140), Dir.Stat (line 176), Dir.Mkdir (line 133), Dir.RemoveAll (line 151)
endpoints/drive/backend.go — NewBackend (line 51–52)

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-42275

CVE-2026-42275:

8.7

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
github.com/openziti/zrok	go	<= 1.1.11
github.com/openziti/zrok/v2	go	< 2.0.2	2.0.2

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability exists in the WebDAV drive backend of zrok, where the davServer.Dir component fails to properly validate and handle symbolic links. This allows an attacker to create a symlink within the shared DriveRoot that points to a location outside of it. Consequently, the WebDAV consumer can read, write, or overwrite files on the host filesystem with the privileges of the zrok process. The patch mitigates this by introducing a new function, resolveBoundedPath, which is used by all the file operation functions (OpenFile, Stat, Mkdir, RemoveAll, Rename). This new function securely resolves file paths by checking for symlinks and ensuring they do not resolve to a path outside the intended DriveRoot. If a symlink escape is detected, it returns a permission error, thus preventing the path traversal vulnerability.

Vulnerable functions

Dir.OpenFile

drives/davServer/file.go

The `OpenFile` function is vulnerable because it uses `d.resolve(name)` to determine the file path, which does not properly handle symbolic links. This allows an attacker to create a symbolic link to a file outside of the intended `DriveRoot` and then use this function to open and read or write to that file. The patch replaces `d.resolve(name)` with `d.resolveBoundedPath(name, ...)` which securely resolves the path and prevents traversal.

Dir.Stat

drives/davServer/file.go

The `Stat` function is vulnerable because it uses `d.resolve(name)` to determine the file path, which does not properly handle symbolic links. This allows an attacker to create a symbolic link to a file or directory outside of the intended `DriveRoot` and then use this function to check for its existence. The patch replaces `d.resolve(name)` with `d.resolveBoundedPath(name, ...)` which securely resolves the path and prevents traversal.

Dir.Mkdir

drives/davServer/file.go

The `Mkdir` function is vulnerable because it uses `d.resolve(name)` to determine the directory path, which does not properly handle symbolic links. This allows an attacker to create a symbolic link to a directory outside of the intended `DriveRoot` and then use this function to create a new directory within that external directory. The patch replaces `d.resolve(name)` with `d.resolveBoundedPath(name, ...)` which securely resolves the path and prevents traversal.

Dir.RemoveAll

drives/davServer/file.go

The `RemoveAll` function is vulnerable because it uses `d.resolve(name)` to determine the path to remove, which does not properly handle symbolic links. This allows an attacker to create a symbolic link to a file or directory outside of the intended `DriveRoot` and then use this function to delete it. The patch replaces `d.resolve(name)` with `d.resolveBoundedPath(name, ...)` which securely resolves the path and prevents traversal.

Dir.Rename

drives/davServer/file.go

The `Rename` function is vulnerable because it uses `d.resolve(name)` to determine the old and new paths, which does not properly handle symbolic links. This allows an attacker to create a symbolic link to a file or directory outside of the intended `DriveRoot` and then use this function to rename it, effectively moving it to a different location. The patch replaces `d.resolve(name)` with `d.resolveBoundedPath(name, ...)` which securely resolves the path and prevents traversal.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.