zrok — Vulnerabilities & Security Advisories 6

All 6 CVE vulnerabilities found in zrok, with AI-generated Chinese analysis, references, and POCs.

CVE ID	Title	CVSS	Severity	Published
CVE-2026-45576	zrok copy writes attacker-controlled WebDAV paths outside the destination root CWE-22	-	-	2026-07-16
CVE-2026-45568	zrok Python ProxyShare can be used as an SSRF proxy through absolute URL paths CWE-22	-	-	2026-07-16
CVE-2026-42275	zrok: WebDAV drive backend follows symlinks outside DriveRoot, enabling host filesystem read/write CWE-61	8.7	High	2026-05-08
CVE-2026-40304	zrok's broken ownership check in DELETE /api/v2/unaccess allows non-admin to delete global frontend records CWE-284	5.3	Medium	2026-04-17
CVE-2026-40303	zrok allows unauthenticated DoS via unbounded memory allocation in striped session cookie parsing CWE-400	7.5	High	2026-04-17
CVE-2026-40302	zrok has reflected XSS in GitHub OAuth callback via unsanitized refreshInterval error rendering CWE-79	6.1	Medium	2026-04-17

All 6 known CVE vulnerabilities affecting zrok with full Chinese analysis, references, and POCs where available.