Path Traversal Vulnerability in Zrok WebDAV Software

CVE-2026-42275

What is CVE-2026-42275?

Zrok, a software solution for sharing web services and files, contains a flaw in its WebDAV drive backend, which allows remote WebDAV clients to bypass path restrictions. This occurs due to improper handling of symbolic links in shared drives that point outside the designated root directory. Without sufficient OS-level permission controls, this vulnerability can lead to unauthorized reading of sensitive files and potential overwrites in the host filesystem. The issue has been resolved in version 2.0.2, underscoring the importance of keeping software up to date to mitigate security risks.

References