CVE-2026-45576

Name of the Vulnerable Software and Affected Versions zrok (affected versions not specified)

Description A path traversal issue exists when using the zrok2 copy command to move files from a WebDAV or zrok drive to a local filesystem. An attacker can provide a malicious DAV href containing directory traversal sequences, such as /../outside.txt. This path is processed by the FilesystemTarget.WriteStream function, which joins the input with the target root, allowing files to be created or overwritten outside the intended destination directory using the credentials of the user performing the sync.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.