Dashboard / CVE-2026-45576

CVE-2026-45576

HIGH
MEDIUM Priority: 0.04 BB Relevance: 67/100
Published: 2026-07-16 Modified: 2026-10-24 First seen: 2026-10-29 Status: active

Attack Surface

Network Low Complexity No Auth Integ. Impact

CVSS Vector Breakdown

AV: Network
AC: Low
PR: None
UI: Active
S: X
AT: None
VC: None
VI: High
VA: None

Description

zrok is software for sharing web services, files, and network resources. From 0.4.23 until 2.0.3, `zrok2 copy` stores attacker-controlled WebDAV or zrok drive paths such as /../outside.txt in the source inventory and passes them to FilesystemTarget.WriteStream, allowing the sync pipeline to write files outside the selected local filesystem destination root. This issue is fixed in version 2.0.3.

Weakness Classification (1)

Affected Software (1)

VendorProductVersion
netfoundry zrok 0.4.23 – 2.0.3

References & Advisories (3)

Bug Bounty Relevance

67 / 100
✓ Network accessible
✓ No authentication
✓ Low complexity

CVSS Score

8.3 / 10.0 v4.0
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:H/VA:N/SC:H/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

EPSS — Exploitation Probability

0.50%
Raw Score 0.004960
Percentile 42.5%
Date 2026-10-29

EPSS Trend

2026-10-29
0.00496
2026-10-28
0.00496

Intelligence Sources

nvd ref →

External Links