CVE-2026-33529
Published: 26 March 2026
Summary
CVE-2026-33529 is a low-severity Path Traversal (CWE-22) vulnerability in Zoraxy Zoraxy. Its CVSS base score is 3.3 (Low).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 34.6th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Deeper analysis
CVE-2026-33529 is an authenticated path traversal vulnerability (CWE-22) affecting Zoraxy, an open-source general-purpose HTTP reverse proxy and forwarding tool. In versions prior to 3.3.2, the configuration import endpoint allows an authenticated user to write arbitrary files outside the designated config directory. This flaw has a CVSS v3.1 base score of 3.3 (AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:L/A:N), indicating low severity with network accessibility but requiring high privileges and attack complexity.
An authenticated user with high privileges (PR:H) can exploit this vulnerability remotely over the network by sending a crafted request to the configuration import endpoint. Successful exploitation enables writing files to arbitrary locations on the server, potentially leading to remote code execution (RCE) through the creation of a malicious plugin. The impact is limited to low confidentiality and integrity effects with no availability disruption.
The Zoraxy project addressed this issue in version 3.3.2, which patches the path traversal vulnerability. Security practitioners should upgrade to this version immediately. Relevant resources include the patching commit at https://github.com/tobychui/zoraxy/commit/69ac755aeec5d15ba4c62099f7f1ed77a855b40b, the release notes at https://github.com/tobychui/zoraxy/releases/tag/v3.3.2, and the security advisory at https://github.com/tobychui/zoraxy/security/advisories/GHSA-7pq3-326h-f8q9.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-16357
Vulnerability details
Zoraxy is a general purpose HTTP reverse proxy and forwarding tool. Prior to version 3.3.2, an authenticated path traversal vulnerability in the configuration import endpoint allows an authenticated user to write arbitrary files outside the config directory, which can lead…
more
to RCE by creating a plugin. Version 3.3.2 patches the issue.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Authenticated arbitrary file write via path traversal in public-facing reverse proxy directly enables exploitation of the application for initial access (T1190) and deployment of malicious plugin code for RCE (T1505.003).
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Timely remediation through patching to version 3.3.2 directly eliminates the path traversal vulnerability in the configuration import endpoint.
Validating file paths in inputs to the configuration import endpoint prevents authenticated users from traversing outside the designated config directory.
Authorizing and restricting access to configuration changes limits exploitation of the config import endpoint to only necessary high-privilege personnel.