- Latest release
- Not known: cve.now hasn't read this package's releases
- Newest unaffected release
- Not known without release data
- Advisories
- 5 · 3 high, 2 medium
- Registry
- pkg.go.dev
Advisories 5
- CVE-2026-45576High 8.3
zrok copy writes attacker-controlled WebDAV paths outside the destination root
Affected: from 0.4.23, through 1.1.11; from 0.4.23.
- CVE-2026-42275High 8.7
zrok: WebDAV drive backend follows symlinks outside DriveRoot, enabling host filesystem read/write
Affected: through 1.1.11; all versions.
- CVE-2026-40304Medium 5.3
zrok's broken ownership check in DELETE /api/v2/unaccess allows non-admin to delete global frontend records
Affected: all versions; through 1.1.11.
- CVE-2026-40303High 7.5
zrok allows unauthenticated DoS via unbounded memory allocation in striped session cookie parsing
Affected: all versions; through 1.1.11.
- CVE-2026-40302Medium 6.1
zrok has reflected XSS in GitHub OAuth callback via unsanitized refreshInterval error rendering
Affected: through 1.1.11; all versions.