CVE-2026-33529

Published: Mar 26, 2026Modified: Jun 17, 2026

8.8

Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Exploitability: 2.8 / Impact: 5.9

Source: NVD

Description

Zoraxy is a general purpose HTTP reverse proxy and forwarding tool. Prior to version 3.3.2, an authenticated path traversal vulnerability in the configuration import endpoint allows an authenticated user to write arbitrary files outside the config directory, which can lead to RCE by creating a plugin. Version 3.3.2 patches the issue.

Affected (1)

Products: Zoraxy: Zoraxy

1 product

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Zoraxy Zoraxy	Before 3.3.2

Related CWEs

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

References (3)

https://github.com/tobychui/zoraxy/commit/69ac755aeec5d15ba4c62099f7f1ed77a855b40b

Source: security-advisories@github.com

Patch

https://github.com/tobychui/zoraxy/releases/tag/v3.3.2

Source: security-advisories@github.com

Release Notes

https://github.com/tobychui/zoraxy/security/advisories/GHSA-7pq3-326h-f8q9

Source: security-advisories@github.com

ExploitVendor Advisory

Timeline

No history available yet.