- Latest release
- Not known: cve.now hasn't read this package's releases
- Newest unaffected release
- Not known without release data
- Advisories
- 5 · 3 high, 2 medium
- Registry
- pkg.go.dev
Advisories 5
- CVE-2026-45576High 8.3
zrok copy writes attacker-controlled WebDAV paths outside the destination root
Affected: fixed in 2.0.3.
- CVE-2026-42275High 8.7
zrok: WebDAV drive backend follows symlinks outside DriveRoot, enabling host filesystem read/write
Affected: fixed in 2.0.2.
- CVE-2026-40304Medium 5.3
zrok's broken ownership check in DELETE /api/v2/unaccess allows non-admin to delete global frontend records
Affected: fixed in 2.0.1.
- CVE-2026-40303High 7.5
zrok allows unauthenticated DoS via unbounded memory allocation in striped session cookie parsing
Affected: fixed in 2.0.1.
- CVE-2026-40302Medium 6.1
zrok has reflected XSS in GitHub OAuth callback via unsanitized refreshInterval error rendering
Affected: fixed in 2.0.1.