CVE-2026-42275 Details

A vulnerability in the Zrok WebDAV drive backend prior to version 2.0.2 allows for symbolic links to be followed outside the designated DriveRoot. This issue enables remote WebDAV consumers to read files and, in shares without operating system-level permission restrictions, write or overwrite files anywhere on the host filesystem that is accessible to the Zrok process. The vulnerability arises because the WebDAV implementation restricts path traversal through lexical normalization but fails to prevent symlink following. Exploitation can be performed entirely over the WebDAV endpoint, without requiring authentication, user interaction, or special privileges.

Users can update to Zrok version 2.0.2 or later, where this vulnerability has been fixed.