CVE-2026-33529

LowPublic PoC

Published: 26 March 2026

Published

26 March 2026

Modified

02 April 2026

KEV Added

—

Patch

—

CVSS Score 3.3 CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:L/A:N

EPSS Score 0.0002 6.8th percentile

Risk Priority 7 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2026-33529 is a low-severity Path Traversal (CWE-22) vulnerability in Zoraxy Zoraxy. Its CVSS base score is 3.3 (Low).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 6.8th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.

The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).

Threat & Defense at a Glance

What attackers do: exploitation maps to Exploit Public-Facing Application (T1190) and 1 other technique. What defenders deploy: see the NIST 800-53 controls recommended below.

Threat & Defense Details

Mitigating Controls (NIST 800-53 r5)AI

SI-2 Flaw Remediation good match

prevent

Timely remediation through patching to version 3.3.2 directly eliminates the path traversal vulnerability in the configuration import endpoint.

SI-10 Information Input Validation good match

prevent

Validating file paths in inputs to the configuration import endpoint prevents authenticated users from traversing outside the designated config directory.

CM-5 Access Restrictions for Change partial match

prevent

Authorizing and restricting access to configuration changes limits exploitation of the config import endpoint to only necessary high-privilege personnel.

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access

Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.

attack.mitre.org →

T1505.003 Web Shell Persistence

Adversaries may backdoor web servers with web shells to establish persistent access to systems.

attack.mitre.org →

Why these techniques?

Authenticated arbitrary file write via path traversal in public-facing reverse proxy directly enables exploitation of the application for initial access (T1190) and deployment of malicious plugin code for RCE (T1505.003).

Confidence: HIGH · MITRE ATT&CK Enterprise v18.1

NVD Description

Zoraxy is a general purpose HTTP reverse proxy and forwarding tool. Prior to version 3.3.2, an authenticated path traversal vulnerability in the configuration import endpoint allows an authenticated user to write arbitrary files outside the config directory, which can lead…

to RCE by creating a plugin. Version 3.3.2 patches the issue.

Deeper analysisAI

CVE-2026-33529 is an authenticated path traversal vulnerability (CWE-22) affecting Zoraxy, an open-source general-purpose HTTP reverse proxy and forwarding tool. In versions prior to 3.3.2, the configuration import endpoint allows an authenticated user to write arbitrary files outside the designated config directory. This flaw has a CVSS v3.1 base score of 3.3 (AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:L/A:N), indicating low severity with network accessibility but requiring high privileges and attack complexity.

An authenticated user with high privileges (PR:H) can exploit this vulnerability remotely over the network by sending a crafted request to the configuration import endpoint. Successful exploitation enables writing files to arbitrary locations on the server, potentially leading to remote code execution (RCE) through the creation of a malicious plugin. The impact is limited to low confidentiality and integrity effects with no availability disruption.

The Zoraxy project addressed this issue in version 3.3.2, which patches the path traversal vulnerability. Security practitioners should upgrade to this version immediately. Relevant resources include the patching commit at https://github.com/tobychui/zoraxy/commit/69ac755aeec5d15ba4c62099f7f1ed77a855b40b, the release notes at https://github.com/tobychui/zoraxy/releases/tag/v3.3.2, and the security advisory at https://github.com/tobychui/zoraxy/security/advisories/GHSA-7pq3-326h-f8q9.