CVE-2026-33529
Zoraxy: Authenticated Path Traversal in Config Import leads to RCE
概要
Zoraxy: Authenticated Path Traversal in Config Import leads to RCE
原文の説明
取得元が公開している説明をそのまま載せています (多くは英語)。
Zoraxy is a general purpose HTTP reverse proxy and forwarding tool. Prior to version 3.3.2, an authenticated path traversal vulnerability in the configuration import endpoint allows an authenticated user to write arbitrary files outside the config directory, which can lead to RCE by creating a plugin. Version 3.3.2 patches the issue.
出典: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV
参照URL
- advisory github.com
- advisory github.com
- advisory nvd.nist.gov
- patch github.com
- web github.com