Cloudanix VulnDB

CVE-2026-45576

Critical · 9.3

zrok copy writes attacker-controlled WebDAV paths outside the destination root

CVSS

9.3

EPSS

0.5%

Published

May 19, 2026

CISA due date

—

The record

Alice runs `zrok2 copy` from a WebDAV or zrok drive controlled by Bob into a local filesystem target. Bob returns a DAV `href` such as `/../outside.txt`. The sync pipeline stores that path in the source inventory and passes it to `FilesystemTarget.WriteStream`, which joins it with the target root and creates the file outside Alice's selected directory.

Affected packages

Ecosystem Package Introduced Fixed

Related vulnerabilities