Skip to content
Security
فارسی
Sign in / Register
Vulnerabilities
Products
Plugins
All products
github.com/openziti/zrok
Go
· Package
5 reports
Vulnerability alerts
Follow
Package, identifier or title
Search
Severity
All
Critical
High
Medium
Low
Unknown
Fix status
All
Fix reported
No fix reported
Sort by
Recently updated
Highest severity
Report
Product
Ecosystem
Severity
Fix status
Last updated
zrok copy writes attacker-controlled WebDAV paths outside the destination root
CVE-2026-45576 · GHSA-C656-JCX2-7PQJ
Version ranges need review.
github.com/openziti/zrok/v2
github.com/openziti/zrok
Go
High
Fix reported
2026-06-25
zrok: WebDAV drive backend follows symlinks outside DriveRoot, enabling host filesystem read/write
CVE-2026-42275 · GHSA-74M3-9QVM-RP9H
Version ranges need review.
github.com/openziti/zrok/v2
github.com/openziti/zrok
Go
High
Fix reported
2026-06-25
zrok: Unauthenticated DoS via unbounded memory allocation in striped session cookie parsing
CVE-2026-40303 · GHSA-CPF9-PH2J-CCR9
Version ranges need review.
github.com/openziti/zrok/v2
github.com/openziti/zrok
Go
High
Fix reported
2026-06-25
zrok: Broken ownership check in DELETE /api/v2/unaccess allows non-admin to delete global frontend records
CVE-2026-40304 · GHSA-3JPJ-V3XR-5H6G
Version ranges need review.
github.com/openziti/zrok/v2
github.com/openziti/zrok
Go
Medium
Fix reported
2026-06-25
zrok: Reflected XSS in GitHub OAuth callback via unsanitized refreshInterval error rendering
CVE-2026-40302 · GHSA-4FXQ-2X3X-6XQX
Version ranges need review.
github.com/openziti/zrok/v2
github.com/openziti/zrok
Go
Medium
Fix reported
2026-06-25
