Path Traversal Vulnerability in Zoraxy HTTP Reverse Proxy Tool
CVE-2026-33529

3.3LOW

Key Information:

Vendor

Tobychui

Status
Zoraxy
Vendor
CVE Published:
26 March 2026

What is CVE-2026-33529?

An authenticated path traversal vulnerability was identified in the configuration import endpoint of the Zoraxy HTTP reverse proxy tool. This flaw enables an authenticated user to write arbitrary files outside of the designated configuration directory. Such a capability can escalate to remote code execution (RCE) by allowing the creation of malicious plugins. The issue has been addressed in version 3.3.2, which patches this security vulnerability. Users are advised to upgrade to the latest version to mitigate potential risks.

Affected Version(s)

zoraxy < 3.3.2

References

https://github.com/tobychui/zoraxy/security/advisories/GH...
x_refsource_CONFIRM
https://github.com/tobychui/zoraxy/commit/69ac755aeec5d15...
x_refsource_MISC
https://github.com/tobychui/zoraxy/releases/tag/v3.3.2
x_refsource_MISC

CVSS V3.1

Score:
3.3
Severity:
LOW
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
High
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.