Netfoundry

Zrok

6 Schwachstellen gefunden.

Hinweis: Diese Liste kann unvollständig sein. Daten werden ohne Gewähr im Ursprungsformat bereitgestellt.
7.5

CVE-2026-45576

  • EPSS 0.34%
  • Veröffentlicht 16.07.2026 16:45:52
  • Zuletzt bearbeitet 20.07.2026 01:54:51

zrok is software for sharing web services, files, and network resources. From 0.4.23 until 2.0.3, `zrok2 copy` stores attacker-controlled WebDAV or zrok drive paths such as /../outside.txt in the source inventory and passes them to FilesystemTarget.W...

9.1

CVE-2026-45568

  • EPSS 0.36%
  • Veröffentlicht 16.07.2026 16:45:00
  • Zuletzt bearbeitet 20.07.2026 01:58:23

zrok is software for sharing web services, files, and network resources. Prior to 2.0.3, zrok's Python SDK ProxyShare Flask proxy route accepts an absolute URL in the request path and passes it to urllib.parse.urljoin, allowing the requested path to ...

8.7

CVE-2026-42275

  • EPSS 0.33%
  • Veröffentlicht 08.05.2026 03:45:57
  • Zuletzt bearbeitet 08.05.2026 20:03:27

zrok is software for sharing web services, files, and network resources. Prior to version 2.0.2, the zrok WebDAV drive backend (davServer.Dir) restricts path traversal through lexical normalization but does not prevent symlink following. When a symbo...

5.3

CVE-2026-40304

  • EPSS 0.29%
  • Veröffentlicht 17.04.2026 21:04:23
  • Zuletzt bearbeitet 23.04.2026 18:33:27

zrok is software for sharing web services, files, and network resources. Prior to version 2.0.1, the unaccess handler (controller/unaccess.go) contains a logical error in its ownership guard: when a frontend record has environment_id = NULL (the mark...

7.5

CVE-2026-40303

  • EPSS 0.45%
  • Veröffentlicht 17.04.2026 21:01:51
  • Zuletzt bearbeitet 23.04.2026 18:33:09

zrok is software for sharing web services, files, and network resources. Prior to version 2.0.1, endpoints.GetSessionCookie parses an attacker-supplied cookie chunk count and calls make([]string, count) with no upper bound before any token validation...

6.1

CVE-2026-40302

  • EPSS 0.21%
  • Veröffentlicht 17.04.2026 20:56:08
  • Zuletzt bearbeitet 23.04.2026 18:32:53

zrok is software for sharing web services, files, and network resources. Prior to version 2.0.1, the proxyUi template engine uses Go's text/template (which performs no HTML escaping) instead of html/template. The GitHub OAuth callback handlers in bot...