High severity7.5GHSA Advisory· Published Jul 16, 2026· Updated Jul 20, 2026
CVE-2026-45576
CVE-2026-45576
Description
zrok is software for sharing web services, files, and network resources. From 0.4.23 until 2.0.3, zrok2 copy stores attacker-controlled WebDAV or zrok drive paths such as /../outside.txt in the source inventory and passes them to FilesystemTarget.WriteStream, allowing the sync pipeline to write files outside the selected local filesystem destination root. This issue is fixed in version 2.0.3.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
github.com/openziti/zrok/v2Go | < 2.0.3 | 2.0.3 |
github.com/openziti/zrokGo | >= 0.4.23, <= 1.1.11 | — |
Affected products
3- osv-coordsRange: < 0.0.20260723T184607-160000.1.1
Patches
Vulnerability mechanics
References
4- github.com/openziti/zrok/commit/a5811e61589d2f804267c6de4a9056db1bdea457nvdPatch
- github.com/advisories/GHSA-c656-jcx2-7pqjghsaADVISORY
- github.com/openziti/zrok/security/advisories/GHSA-c656-jcx2-7pqjnvdVendor AdvisoryWEB
- github.com/openziti/zrok/releases/tag/v2.0.3nvdRelease Notes
News mentions
0No linked articles in our index yet.