https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sat, 17 Oct 2026 17:34:02 +0000 https://cve.radiocsirt.org/vuln/cve-2026-33528 <p><strong>Affected:</strong> yusing godoxy</p> <p>GoDoxy is a reverse proxy and container orchestrator for self-hosters. Prior to version 0.27.5, the file content API endpoint at `/api/v1/file/content` is vulnerable to path traversal. The `filename` query parameter is passed directly to `path.Join(common.ConfigBasePath, filename)` where `ConfigBasePath = &#34;config&#34;` (a relative path). No sanitization or validation is applied beyond checking that the field is non-empty (`binding:&#34;required&#34;`). An authenticated attacker can use `../` sequences to read or write files outside the intended `config/` directory, including TLS private keys, OAuth refresh tokens, and any file accessible to the container&#39;s UID. Version 0.27.5 fixes the issue.</p> <p><strong>Affected:</strong> yusing godoxy</p> <p>GoDoxy is a reverse proxy and container orchestrator for self-hosters. Prior to version 0.27.5, the file content API endpoint at `/api/v1/file/content` is vulnerable to path traversal. The `filename` query parameter is passed directly to `path.Join(common.ConfigBasePath, filename)` where `ConfigBasePath = &#34;config&#34;` (a relative path). No sanitization or validation is applied beyond checking that the field is non-empty (`binding:&#34;required&#34;`). An authenticated attacker can use `../` sequences to read or write files outside the intended `config/` directory, including TLS private keys, OAuth refresh tokens, and any file accessible to the container&#39;s UID. Version 0.27.5 fixes the issue.</p> https://cve.radiocsirt.org/vuln/cve-2026-33528