Go to main page
Versions in this module
v2
Oct 30, 2026
Oct 8, 2026
Oct 3, 2026
Sep 29, 2026
Sep 27, 2026
May 18, 2026
May 7, 2026
Apr 20, 2026 GO-2026-5315
GO-2026-5315: zrok copy writes attacker-controlled WebDAV paths outside the destination root in github.com/openziti/zrok
Mar 30, 2026 GO-2026-5203 +1 more
GO-2026-5203: zrok: WebDAV drive backend follows symlinks outside DriveRoot, enabling host filesystem read/write in github.com/openziti/zrok
GO-2026-5315: zrok copy writes attacker-controlled WebDAV paths outside the destination root in github.com/openziti/zrok
Mar 23, 2026 GO-2026-5090 +4 more
GO-2026-5090: zrok: Broken ownership check in DELETE /api/v2/unaccess allows non-admin to delete global frontend records in github.com/openziti/zrok
GO-2026-5118: zrok: Reflected XSS in GitHub OAuth callback via unsanitized refreshInterval error rendering in github.com/openziti/zrok
GO-2026-5203: zrok: WebDAV drive backend follows symlinks outside DriveRoot, enabling host filesystem read/write in github.com/openziti/zrok
GO-2026-5315: zrok copy writes attacker-controlled WebDAV paths outside the destination root in github.com/openziti/zrok
GO-2026-5329: zrok: Unauthenticated DoS via unbounded memory allocation in striped session cookie parsing in github.com/openziti/zrok
Changes in this version
Mar 23, 2026 GO-2026-5090 +4 more
GO-2026-5090: zrok: Broken ownership check in DELETE /api/v2/unaccess allows non-admin to delete global frontend records in github.com/openziti/zrok
GO-2026-5118: zrok: Reflected XSS in GitHub OAuth callback via unsanitized refreshInterval error rendering in github.com/openziti/zrok
GO-2026-5203: zrok: WebDAV drive backend follows symlinks outside DriveRoot, enabling host filesystem read/write in github.com/openziti/zrok
GO-2026-5315: zrok copy writes attacker-controlled WebDAV paths outside the destination root in github.com/openziti/zrok
GO-2026-5329: zrok: Unauthenticated DoS via unbounded memory allocation in striped session cookie parsing in github.com/openziti/zrok
Mar 18, 2026 GO-2026-5090 +4 more
GO-2026-5090: zrok: Broken ownership check in DELETE /api/v2/unaccess allows non-admin to delete global frontend records in github.com/openziti/zrok
GO-2026-5118: zrok: Reflected XSS in GitHub OAuth callback via unsanitized refreshInterval error rendering in github.com/openziti/zrok
GO-2026-5203: zrok: WebDAV drive backend follows symlinks outside DriveRoot, enabling host filesystem read/write in github.com/openziti/zrok
GO-2026-5315: zrok copy writes attacker-controlled WebDAV paths outside the destination root in github.com/openziti/zrok
GO-2026-5329: zrok: Unauthenticated DoS via unbounded memory allocation in striped session cookie parsing in github.com/openziti/zrok
Mar 4, 2026 GO-2026-5090 +4 more
GO-2026-5090: zrok: Broken ownership check in DELETE /api/v2/unaccess allows non-admin to delete global frontend records in github.com/openziti/zrok
GO-2026-5118: zrok: Reflected XSS in GitHub OAuth callback via unsanitized refreshInterval error rendering in github.com/openziti/zrok
GO-2026-5203: zrok: WebDAV drive backend follows symlinks outside DriveRoot, enabling host filesystem read/write in github.com/openziti/zrok
GO-2026-5315: zrok copy writes attacker-controlled WebDAV paths outside the destination root in github.com/openziti/zrok
GO-2026-5329: zrok: Unauthenticated DoS via unbounded memory allocation in striped session cookie parsing in github.com/openziti/zrok
Mar 3, 2026 GO-2026-5090 +4 more
GO-2026-5090: zrok: Broken ownership check in DELETE /api/v2/unaccess allows non-admin to delete global frontend records in github.com/openziti/zrok
GO-2026-5118: zrok: Reflected XSS in GitHub OAuth callback via unsanitized refreshInterval error rendering in github.com/openziti/zrok
GO-2026-5203: zrok: WebDAV drive backend follows symlinks outside DriveRoot, enabling host filesystem read/write in github.com/openziti/zrok
GO-2026-5315: zrok copy writes attacker-controlled WebDAV paths outside the destination root in github.com/openziti/zrok
GO-2026-5329: zrok: Unauthenticated DoS via unbounded memory allocation in striped session cookie parsing in github.com/openziti/zrok
Feb 4, 2026 GO-2026-5090 +4 more
GO-2026-5090: zrok: Broken ownership check in DELETE /api/v2/unaccess allows non-admin to delete global frontend records in github.com/openziti/zrok
GO-2026-5118: zrok: Reflected XSS in GitHub OAuth callback via unsanitized refreshInterval error rendering in github.com/openziti/zrok
GO-2026-5203: zrok: WebDAV drive backend follows symlinks outside DriveRoot, enabling host filesystem read/write in github.com/openziti/zrok
GO-2026-5315: zrok copy writes attacker-controlled WebDAV paths outside the destination root in github.com/openziti/zrok
GO-2026-5329: zrok: Unauthenticated DoS via unbounded memory allocation in striped session cookie parsing in github.com/openziti/zrok
Dec 19, 2025 GO-2026-5090 +4 more
GO-2026-5090: zrok: Broken ownership check in DELETE /api/v2/unaccess allows non-admin to delete global frontend records in github.com/openziti/zrok
GO-2026-5118: zrok: Reflected XSS in GitHub OAuth callback via unsanitized refreshInterval error rendering in github.com/openziti/zrok
GO-2026-5203: zrok: WebDAV drive backend follows symlinks outside DriveRoot, enabling host filesystem read/write in github.com/openziti/zrok
GO-2026-5315: zrok copy writes attacker-controlled WebDAV paths outside the destination root in github.com/openziti/zrok
GO-2026-5329: zrok: Unauthenticated DoS via unbounded memory allocation in striped session cookie parsing in github.com/openziti/zrok