CVEvulnerability

CVE-2026-33529

8.8 HIGH Published 2026-03-26 Modified 2026-06-17 Official page ↗
Status
Analyzed
Published
2026-03-26
Last modified
2026-06-17
Assigner
[email protected]
CVSS 3.1 ([email protected])
3.3 LOW — CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:L/A:N
CVSS 3.1 ([email protected])
8.8 HIGH — CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-22

Description

Zoraxy is a general purpose HTTP reverse proxy and forwarding tool. Prior to version 3.3.2, an authenticated path traversal vulnerability in the configuration import endpoint allows an authenticated user to write arbitrary files outside the config directory, which can lead to RCE by creating a plugin. Version 3.3.2 patches the issue.

Affected configurations

• zoraxy zoraxy (< 3.3.2)

Related

Weakness · CWE (1)

  • CWE-22 Improper Limitation of a Pathname to a Restricted Directory weakness

References