Vulnerability · Published Mar 26, 2026 · Assigned by GitHub_M

CVE-2026-33529Zoraxy: Authenticated Path Traversal in Config Import leads to RCE

Low 3.3

In plain English

A low-severity path traversal in zoraxy from tobychui. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 39% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)3.3Low

Exploit odds (30 days)0.4%top 61.4% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

Zoraxy is a general purpose HTTP reverse proxy and forwarding tool. Prior to version 3.3.2, an authenticated path traversal vulnerability in the configuration import endpoint allows an authenticated user to write arbitrary files outside the config directory, which can lead to RCE by creating a plugin. Version 3.3.2 patches the issue.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
Go	github.com/tobychui/zoraxy	3.3.2	GHSA-7pq3-326h-f8q9
Go	github.com/tobychui/zoraxy	3.3.2+incompatible	GO-2026-4844

Affected products (as reported)

Vendor	Product	Versions
tobychui	zoraxy	< 3.3.2

Weakness: CWE-22 · Vector: CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:L/A:N

References

https://github.com/tobychui/zoraxy/security/advisories/GHSA-7pq3-326h-f8q9 x_refsource_CONFIRM
https://github.com/tobychui/zoraxy/commit/69ac755aeec5d15ba4c62099f7f1ed77a855b40b x_refsource_MISC
https://github.com/tobychui/zoraxy/releases/tag/v3.3.2 x_refsource_MISC