Lucene search
+L

1 matches found

Github Security Blog
Github Security Blog
added 2026/04/25 11:34 p.m.16 views

zrok: WebDAV drive backend follows symlinks outside DriveRoot, enabling host filesystem read/write

Summary The zrok WebDAV drive backend davServer.Dir restricts path traversal through lexical normalization but does not prevent symlink following. When a symbolic link inside the shared DriveRoot points to a location outside that root, remote WebDAV consumers can read files and—on shares without...

8.7CVSS5.7AI score0.0033EPSS
SaveExploits0References5Affected Software2
Rows per page
Query Builder