EUVD-2026-277786

fkie_cve-2026-33528

GoDoxy is a reverse proxy and container orchestrator for self-hosters. Prior to version 0.27.5, the file content API endpoint at `/api/v1/file/content` is vulnerable to path traversal. The `filename` query parameter is passed directly to `path.Join(common.ConfigBasePath, filename)` where `ConfigBasePath = "config"` (a relative path). No sanitization or validation is applied beyond checking that the field is non-empty (`binding:"required"`). An authenticated attacker can use `../` sequences to read or write files outside the intended `config/` directory, including TLS private keys, OAuth refresh tokens, and any file accessible to the container's UID. Version 0.27.5 fixes the issue.

GHSA-4753-cmc8-8j9v — GoDoxy has a Path Traversal Vulnerability in its File API

Affected: Go: github.com/yusing/godoxy

## Summary

The file content API endpoint at `/api/v1/file/content` is vulnerable to path traversal. The `filename` query parameter is passed directly to `path.Join(common.ConfigBasePath, filename)` where `ConfigBasePath = "config"` (a relative path). No sanitization or validation is applied beyond checking that the field is non-empty (`binding:"required"`).

An authenticated attacker can use `../` sequences to read or write files outside the intended `config/` directory, including TLS private keys, OAuth refresh tokens, and any file accessible to the container's UID.

## Root Cause

**File:** `internal/api/v1/file/get.go`, lines 68-73:

```go func (t FileType) GetPath(filename string) string { if t == FileTypeMiddleware { return path.Join(common.MiddlewareComposeBasePath, filename) } return path.Join(common.ConfigBasePath, filename) } ```

- `common.ConfigBasePath = "config"` — relative path, not absolute - `path.Join("config", "../certs/key.pem")` normalizes to `"certs/key.pem"` — escaping `config/` - No call to `strings.HasPrefix`, `filepath.Rel`, or any containment check exists - The `format:"filename"` struct tag is an OpenAPI/Swagger annotation only, not enforced by the validator

## Proof of Concept

### Environment

- GoDoxy v0.27.4 (`ghcr.io/yusing/godoxy:latest`) - Authentication enabled with default credentials (`admin`/`password`)

### Steps to Reproduce

**Step 1 — Authenticate:**

**Step 2 — Read file outside config/ via path traversal:**

`…

Most recent entries from all

EUVD-2026-277786

fkie_cve-2026-33528

GHSA-4753-cmc8-8j9v — GoDoxy has a Path Traversal Vulnerability in its File API