CVE-2026-45576

HighCVSS 7.5/10Last modified Oct 24, 2026

Description

zrok is software for sharing web services, files, and network resources. From 0.4.23 until 2.0.3, `zrok2 copy` stores attacker-controlled WebDAV or zrok drive paths such as /../outside.txt in the source inventory and passes them to FilesystemTarget.WriteStream, allowing the sync pipeline to write files outside the selected local filesystem destination root. This issue is fixed in version 2.0.3.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Weakness enumeration

CWE-22

Affected software

No affected versions have been published.

Timeline

Published
Jul 16, 2026
Last modified
Oct 24, 2026
NVD status
Analyzed

Related CVEs from 2026

CVE-2026-455776.9Neotoma provides versioned records that persist across agent runs. From 0.6.0 to before 0.11.1, Neotoma can treat public reverse-proxied reqCVE-2026-455788.8WWBN AVideo is an open source video platform. In 29.0 and earlier, there is a classic shell-metacharacter injection. The YPTSocket notificatCVE-2026-455799.9DIRAC is an interware, meaning a software framework for distributed computing. Prior to versions 8.0.79, 9.0.22, and 9.1.10, the RequestManaCVE-2026-45588.8A flaw has been found in Linksys MR9600 2.0.6.206937. Affected is the function smartConnectConfigure of the file SmartConnect.lua. ExecutingCVE-2026-455805.4WWBN AVideo is an open source video platform. In 29.0 and earlier, there is a stored cross-site scripting vulnerability. The Live plugin's "CVE-2026-455815.5fabric-chaincode-java is a Java based implementation of Hyperledger Fabric chaincode shim APIs. From version 2.3.1 to before version 2.5.10,CVE-2026-455826.5n8n-MCP is an MCP server that provides AI assistants access to n8n node documentation, properties, and operations. Prior to 2.51.3, the workCVE-2026-455838.1Improper control of generation of code ('code injection') in Microsoft Exchange Server allows an unauthorized attacker to execute code over CVE-2026-455848.1Heap-based buffer overflow in Microsoft Defender allows an unauthorized attacker to execute code over a network.CVE-2026-455856.8Microsoft is aware of a security feature bypass vulnerability in Windows publicly referred to as "YellowKey". The proof of conceptCVE-2026-455867.8Improper link resolution before file access ('link following') in Windows Collaborative Translation Framework allows an authorized attacker CVE-2026-455887.9Protection mechanism failure in Windows Secure Boot allows an authorized attacker to bypass a security feature locally.