package

Go/github.com/openziti/zrok

pkg:go/github.com/openziti/zrok

MEDIUM5.3Go

zrok: Broken ownership check in DELETE /api/v2/unaccess allows non-admin to delete global frontend records

Modified: 6/25/2026

MEDIUM6.1Go

zrok: Reflected XSS in GitHub OAuth callback via unsanitized refreshInterval error rendering

Modified: 6/25/2026

HIGH8.7Go

zrok: WebDAV drive backend follows symlinks outside DriveRoot, enabling host filesystem read/write

Modified: 6/25/2026

HIGHGo

zrok copy writes attacker-controlled WebDAV paths outside the destination root

Modified: 6/25/2026

HIGH7.5Go

zrok: Unauthenticated DoS via unbounded memory allocation in striped session cookie parsing

Modified: 6/25/2026

—Go

zrok: Broken ownership check in DELETE /api/v2/unaccess allows non-admin to delete global frontend records in github.com/openziti/zrok

Modified: 6/25/2026

—Go

zrok: Reflected XSS in GitHub OAuth callback via unsanitized refreshInterval error rendering in github.com/openziti/zrok

Modified: 6/25/2026

—Go

zrok: WebDAV drive backend follows symlinks outside DriveRoot, enabling host filesystem read/write in github.com/openziti/zrok

Modified: 6/25/2026

—Go

zrok copy writes attacker-controlled WebDAV paths outside the destination root in github.com/openziti/zrok

Modified: 6/25/2026

—Go

zrok: Unauthenticated DoS via unbounded memory allocation in striped session cookie parsing in github.com/openziti/zrok

Modified: 6/25/2026