CVE-2026-33529

Description

Zoraxy is a general purpose HTTP reverse proxy and forwarding tool. Prior to version 3.3.2, an authenticated path traversal vulnerability in the configuration import endpoint allows an authenticated user to write arbitrary files outside the config directory, which can lead to RCE by creating a plugin. Version 3.3.2 patches the issue.

PUBLISHED Reserved 2026-03-20 | Published 2026-03-26 | Updated 2026-03-27 | Assigner GitHub_M

Problem types

CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

Product status

References

github.com/...zoraxy/security/advisories/GHSA-7pq3-326h-f8q9

github.com/...ommit/69ac755aeec5d15ba4c62099f7f1ed77a855b40b

github.com/tobychui/zoraxy/releases/tag/v3.3.2

cve.org (CVE-2026-33529)

nvd.nist.gov (CVE-2026-33529)

Download JSON