Go to main page
Versions in this module
v2
May 18, 2026
May 7, 2026
Apr 20, 2026 GO-2026-5315
GO-2026-5315: zrok copy writes attacker-controlled WebDAV paths outside the destination root in github.com/openziti/zrok
Mar 30, 2026 GO-2026-5203 +1 more
GO-2026-5203: zrok: WebDAV drive backend follows symlinks outside DriveRoot, enabling host filesystem read/write in github.com/openziti/zrok
GO-2026-5315: zrok copy writes attacker-controlled WebDAV paths outside the destination root in github.com/openziti/zrok
Mar 23, 2026 GO-2026-5090 +4 more
GO-2026-5090: zrok: Broken ownership check in DELETE /api/v2/unaccess allows non-admin to delete global frontend records in github.com/openziti/zrok
GO-2026-5118: zrok: Reflected XSS in GitHub OAuth callback via unsanitized refreshInterval error rendering in github.com/openziti/zrok
GO-2026-5203: zrok: WebDAV drive backend follows symlinks outside DriveRoot, enabling host filesystem read/write in github.com/openziti/zrok
GO-2026-5315: zrok copy writes attacker-controlled WebDAV paths outside the destination root in github.com/openziti/zrok
GO-2026-5329: zrok: Unauthenticated DoS via unbounded memory allocation in striped session cookie parsing in github.com/openziti/zrok
Changes in this version
Mar 23, 2026 GO-2026-5090 +4 more
GO-2026-5090: zrok: Broken ownership check in DELETE /api/v2/unaccess allows non-admin to delete global frontend records in github.com/openziti/zrok
GO-2026-5118: zrok: Reflected XSS in GitHub OAuth callback via unsanitized refreshInterval error rendering in github.com/openziti/zrok
GO-2026-5203: zrok: WebDAV drive backend follows symlinks outside DriveRoot, enabling host filesystem read/write in github.com/openziti/zrok
GO-2026-5315: zrok copy writes attacker-controlled WebDAV paths outside the destination root in github.com/openziti/zrok
GO-2026-5329: zrok: Unauthenticated DoS via unbounded memory allocation in striped session cookie parsing in github.com/openziti/zrok
Mar 18, 2026 GO-2026-5090 +4 more
GO-2026-5090: zrok: Broken ownership check in DELETE /api/v2/unaccess allows non-admin to delete global frontend records in github.com/openziti/zrok
GO-2026-5118: zrok: Reflected XSS in GitHub OAuth callback via unsanitized refreshInterval error rendering in github.com/openziti/zrok
GO-2026-5203: zrok: WebDAV drive backend follows symlinks outside DriveRoot, enabling host filesystem read/write in github.com/openziti/zrok
GO-2026-5315: zrok copy writes attacker-controlled WebDAV paths outside the destination root in github.com/openziti/zrok
GO-2026-5329: zrok: Unauthenticated DoS via unbounded memory allocation in striped session cookie parsing in github.com/openziti/zrok
Mar 4, 2026 GO-2026-5090 +4 more
GO-2026-5090: zrok: Broken ownership check in DELETE /api/v2/unaccess allows non-admin to delete global frontend records in github.com/openziti/zrok
GO-2026-5118: zrok: Reflected XSS in GitHub OAuth callback via unsanitized refreshInterval error rendering in github.com/openziti/zrok
GO-2026-5203: zrok: WebDAV drive backend follows symlinks outside DriveRoot, enabling host filesystem read/write in github.com/openziti/zrok
GO-2026-5315: zrok copy writes attacker-controlled WebDAV paths outside the destination root in github.com/openziti/zrok
GO-2026-5329: zrok: Unauthenticated DoS via unbounded memory allocation in striped session cookie parsing in github.com/openziti/zrok
Mar 3, 2026 GO-2026-5090 +4 more
GO-2026-5090: zrok: Broken ownership check in DELETE /api/v2/unaccess allows non-admin to delete global frontend records in github.com/openziti/zrok
GO-2026-5118: zrok: Reflected XSS in GitHub OAuth callback via unsanitized refreshInterval error rendering in github.com/openziti/zrok
GO-2026-5203: zrok: WebDAV drive backend follows symlinks outside DriveRoot, enabling host filesystem read/write in github.com/openziti/zrok
GO-2026-5315: zrok copy writes attacker-controlled WebDAV paths outside the destination root in github.com/openziti/zrok
GO-2026-5329: zrok: Unauthenticated DoS via unbounded memory allocation in striped session cookie parsing in github.com/openziti/zrok
Feb 4, 2026 GO-2026-5090 +4 more
GO-2026-5090: zrok: Broken ownership check in DELETE /api/v2/unaccess allows non-admin to delete global frontend records in github.com/openziti/zrok
GO-2026-5118: zrok: Reflected XSS in GitHub OAuth callback via unsanitized refreshInterval error rendering in github.com/openziti/zrok
GO-2026-5203: zrok: WebDAV drive backend follows symlinks outside DriveRoot, enabling host filesystem read/write in github.com/openziti/zrok
GO-2026-5315: zrok copy writes attacker-controlled WebDAV paths outside the destination root in github.com/openziti/zrok
GO-2026-5329: zrok: Unauthenticated DoS via unbounded memory allocation in striped session cookie parsing in github.com/openziti/zrok
Dec 19, 2025 GO-2026-5090 +4 more
GO-2026-5090: zrok: Broken ownership check in DELETE /api/v2/unaccess allows non-admin to delete global frontend records in github.com/openziti/zrok
GO-2026-5118: zrok: Reflected XSS in GitHub OAuth callback via unsanitized refreshInterval error rendering in github.com/openziti/zrok
GO-2026-5203: zrok: WebDAV drive backend follows symlinks outside DriveRoot, enabling host filesystem read/write in github.com/openziti/zrok
GO-2026-5315: zrok copy writes attacker-controlled WebDAV paths outside the destination root in github.com/openziti/zrok
GO-2026-5329: zrok: Unauthenticated DoS via unbounded memory allocation in striped session cookie parsing in github.com/openziti/zrok