CVE-2026-33529
Zoraxy: Authenticated Path Traversal in Config Import leads to RCE
Résumé
Zoraxy: Authenticated Path Traversal in Config Import leads to RCE
Description d'origine
La description telle que publiée par la source (souvent en anglais).
Zoraxy is a general purpose HTTP reverse proxy and forwarding tool. Prior to version 3.3.2, an authenticated path traversal vulnerability in the configuration import endpoint allows an authenticated user to write arbitrary files outside the config directory, which can lead to RCE by creating a plugin. Version 3.3.2 patches the issue.
Source: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV
Références
- advisory github.com
- advisory github.com
- advisory nvd.nist.gov
- patch github.com
- web github.com