CVE-2026-33529

Katalog CVE

CVSS 8.8 · High EPSS 0,49%

Kerentanan Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') pada zoraxy. Skor CVSS 3.1 8.8 (High) menurut NVD.

Deskripsi (NVD)

Zoraxy is a general purpose HTTP reverse proxy and forwarding tool. Prior to version 3.3.2, an authenticated path traversal vulnerability in the configuration import endpoint allows an authenticated user to write arbitrary files outside the config directory, which can lead to RCE by creating a plugin. Version 3.3.2 patches the issue.

Rincian

Terbit di NVD

26 Maret 2026

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

8.8 (High), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

EPSS (30 hari)

0,49% peluang dieksploitasi; lebih tinggi dari 40,5% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/tobychui/zoraxy/security/advisories/GHSA-7pq3-326h-f8q9 exploit · advisory vendor
• https://github.com/tobychui/zoraxy/commit/69ac755aeec5d15ba4c62099f7f1ed77a855b40b patch
• https://github.com/tobychui/zoraxy/releases/tag/v3.3.2 release notes