zrok WebDAV Vulnerability (CVE-2026-42275) Allows Remote File Access
The zrok software, designed for sharing web services, files, and network resources, has a critical path traversal vulnerability (CVE-2026-42275) in its WebDAV drive backend. Prior to version 2.0.2, zrok’s davServer.Dir component, while attempting lexical normalization, failed to prevent symbolic link following. This oversight creates a severe bypass.
According to the National Vulnerability Database, if a symbolic link within a shared DriveRoot points outside that root, remote WebDAV consumers can read arbitrary files. More alarmingly, on shares lacking OS-level permission restrictions, attackers could write or overwrite files anywhere on the host filesystem, provided the zrok process has the necessary permissions. This is a direct path to system compromise and data manipulation.
This vulnerability carries a CVSSv3.1 score of 8.7 (High), highlighting its significant impact and ease of exploitation. The issue is categorized under CWE-22 (Path Traversal) and CWE-61 (UNIX Symbolic Link Following). Organizations leveraging zrok for file and resource sharing must recognize the immediate risk this poses to data integrity and host system security. The fix is available in zrok version 2.0.2.
What This Means For You
- If your organization uses zrok for file sharing, you are exposed to critical file system compromise. Immediately verify your zrok version. If it's prior to 2.0.2, patch to version 2.0.2 or later without delay. Also, audit your WebDAV share configurations and host OS permissions to ensure zrok processes operate with the absolute minimum necessary privileges.
Related ATT&CK Techniques
🛡️ Detection Rules
3 rules · 6 SIEM formats3 detection rules auto-generated for this incident, mapped to MITRE ATT&CK. Sigma YAML is free — export to any SIEM format via the Intel Bot.
CVE-2026-42275 - zrok WebDAV Path Traversal via Symlink
title: CVE-2026-42275 - zrok WebDAV Path Traversal via Symlink
id: scw-2026-05-08-ai-1
status: experimental
level: critical
description: |
Detects attempts to exploit the zrok WebDAV vulnerability (CVE-2026-42275) by observing WebDAV requests containing path traversal sequences ('../') within the URI, targeting the '/dav/' endpoint. This indicates an attempt to access files outside the intended shared directory via symlink following.
author: SCW Feed Engine (AI-generated)
date: 2026-05-08
references:
- https://shimiscyberworld.com/posts/nvd-CVE-2026-42275/
tags:
- attack.initial_access
- attack.t1190
logsource:
category: webserver
detection:
selection:
cs-uri|contains:
- '/dav/'
cs-method|exact:
- 'GET'
cs-uri-query|contains:
- '../'
condition: selection
falsepositives:
- Legitimate administrative activity
Source: Shimi's Cyber World · License & reuse
Indicators of Compromise
| ID | Type | Indicator |
|---|---|---|
| CVE-2026-42275 | Path Traversal | zrok software versions prior to 2.0.2 |
| CVE-2026-42275 | Path Traversal | zrok WebDAV drive backend (davServer.Dir) symlink following vulnerability |
| CVE-2026-42275 | Information Disclosure | Remote WebDAV consumers can read files outside DriveRoot via symlinks |
| CVE-2026-42275 | Arbitrary File Write | Remote WebDAV consumers can write/overwrite files outside DriveRoot via symlinks (on shares without OS-level permission restrictions) |
Written by SCW Vulnerability Desk
Source & Attribution
| Source Platform | NVD |
| Channel | National Vulnerability Database |
| Published | May 08, 2026 at 07:16 UTC |
This content was AI-rewritten and enriched by Shimi's Cyber World based on the original source. All intellectual property rights remain with the original author.
Believe this infringes your rights? Submit a takedown request.
Related coverage
CVE-2026-6667 — PgBouncer before 1.25.2 did not perform an appropriate
CVE-2026-6667 — PgBouncer before 1.25.2 did not perform an appropriate authorization check for the KILL_CLIENT admin command. All users with access to the administration console...
CVE-2026-6666 — A possible null pointer reference in PgBouncer before
CVE-2026-6666 — A possible null pointer reference in PgBouncer before 1.25.2 could lead to a crash, if a server sends an error response without SQLSTATE...
PgBouncer SCRAM Vulnerability (CVE-2026-6665) Allows Stack Overflow
CVE-2026-6665 — The SCRAM code in PgBouncer before 1.25.2 did not check the return value of strlcat() correctly when building the contents of the SCRAM...