Lucene search
+L

1 matches found

Github Security Blog
Github Security Blog
•added 2026/04/25 11:34 p.m.•24 views

zrok: WebDAV drive backend follows symlinks outside DriveRoot, enabling host filesystem read/write

Summary The zrok WebDAV drive backend davServer.Dir restricts path traversal through lexical normalization but does not prevent symlink following. When a symbolic link inside the shared DriveRoot points to a location outside that root, remote WebDAV consumers can read files and—on shares without...

8.7CVSS8.2AI score0.0046EPSS
SaveExploits0References5Affected Software2
Rows per page
Query Builder