CVE-2026-33529

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-33529
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-33529.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-33529
Aliases
Downstream
Related
Published
2026-03-26T19:26:32.646Z
Modified
2026-04-10T05:42:49.566024Z
Severity
  • 3.3 (Low) CVSS_V3 - CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:L/A:N CVSS Calculator
Summary
Zoraxy: Authenticated Path Traversal in Config Import leads to RCE
Details

Zoraxy is a general purpose HTTP reverse proxy and forwarding tool. Prior to version 3.3.2, an authenticated path traversal vulnerability in the configuration import endpoint allows an authenticated user to write arbitrary files outside the config directory, which can lead to RCE by creating a plugin. Version 3.3.2 patches the issue.

Database specific 
{
    "cwe_ids": [
        "CWE-22"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/33xxx/CVE-2026-33529.json",
    "cna_assigner": "GitHub_M"
}
References

Affected packages

Git / github.com/tobychui/zoraxy

Affected ranges

Type
GIT
Repo
https://github.com/tobychui/zoraxy
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
a1d61128039253b962ca5373a20749d05c6ae933
Database specific 
{
    "versions": [
        {
            "introduced": "0"
        },
        {
            "fixed": "3.3.2"
        }
    ]
}

Affected versions

2.*
2.1
2.2
2.3
2.4
2.5
2.6
2.6.2
2.6.3
2.6.4
2.6.5
2.6.6
2.6.7
2.6.8
3.*
3.0.0
3.0.1
3.0.2
3.0.3
3.0.4
3.0.5
3.0.6
3.0.7
3.0.8
3.0.9
3.1.0
3.1.1
3.1.1r2
v3.*
v3.1.1r3
v3.1.2
v3.1.3
v3.1.4
v3.1.5
v3.1.6
v3.1.7
v3.1.8
v3.1.9
v3.2.0
v3.2.1
v3.2.2
v3.2.3
v3.2.4
v3.2.5
v3.2.5r2
v3.2.6
v3.2.7
v3.2.8
v3.2.9
v3.3.0
v3.3.0-rc3
v3.3.1
v3.3.1-rc1
v3.3.1-rc2
v3.3.1-rc3
v3.3.2-rc1
v3.3.2-rc2
v3.3.2-rc3
v3.3.2-rc4

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-33529.json"