Netfoundry
Netfoundry Zrok: vulnerabilities and CVEs
Netfoundry Zrok has 6 published vulnerabilities, 6 of them in the last 12 months. 1 are rated critical and 0 are listed by CISA as actively exploited.
CVEs6
Last 12 months6
Critical1
Actively exploited0
All vulnerabilities in the catalogue →⭐ Follow this technology
Latest vulnerabilities
| CVE | Severity | EPSS | Active exploitation | Published | Description |
|---|---|---|---|---|---|
| CVE-2026-45576 | High (8.3) | 0.50% | — | Jul 16, 2026 | zrok is software for sharing web services, files, and network resources. From 0.4.23 until 2.0.3, `zrok2 copy` stores attacker-controlled WebDAV or zrok drive paths such as /../outside.txt in the source inventory and… |
| CVE-2026-45568 | Critical (9.9) | 0.54% | — | Jul 16, 2026 | zrok is software for sharing web services, files, and network resources. Prior to 2.0.3, zrok's Python SDK ProxyShare Flask proxy route accepts an absolute URL in the request path and passes it to urllib.parse.urljoin,… |
| CVE-2026-42275 | High (8.7) | 0.46% | — | May 8, 2026 | zrok is software for sharing web services, files, and network resources. Prior to version 2.0.2, the zrok WebDAV drive backend (davServer.Dir) restricts path traversal through lexical normalization but does not prevent… |
| CVE-2026-40304 | Medium (5.3) | 0.36% | — | Apr 17, 2026 | zrok is software for sharing web services, files, and network resources. Prior to version 2.0.1, the unaccess handler (controller/unaccess.go) contains a logical error in its ownership guard: when a frontend record has… |
| CVE-2026-40303 | High (7.5) | 0.59% | — | Apr 17, 2026 | zrok is software for sharing web services, files, and network resources. Prior to version 2.0.1, endpoints.GetSessionCookie parses an attacker-supplied cookie chunk count and calls make([]string, count) with no upper… |
| CVE-2026-40302 | Medium (6.1) | 0.26% | — | Apr 17, 2026 | zrok is software for sharing web services, files, and network resources. Prior to version 2.0.1, the proxyUi template engine uses Go's text/template (which performs no HTML escaping) instead of html/template. The GitHub… |
🎯 How it gets exploited (ATT&CK techniques)
Number of CVEs of this technology mapped to each exploitation or primary-impact technique.