CVE-2026-33529

{"id": "CVE-2026-33529", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 3.3, "attackVector": "NETWORK", "baseSeverity": "LOW", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "NONE", "privilegesRequired": "HIGH", "confidentialityImpact": "LOW"}, "impactScore": 2.5, "exploitabilityScore": 0.7}, {"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.8, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 2.8}]}, "published": "2026-03-26T20:16:15.070", "references": [{"url": "https://github.com/tobychui/zoraxy/commit/69ac755aeec5d15ba4c62099f7f1ed77a855b40b", "tags": ["Patch"], "source": "security-advisories@github.com"}, {"url": "https://github.com/tobychui/zoraxy/releases/tag/v3.3.2", "tags": ["Release Notes"], "source": "security-advisories@github.com"}, {"url": "https://github.com/tobychui/zoraxy/security/advisories/GHSA-7pq3-326h-f8q9", "tags": ["Exploit", "Vendor Advisory"], "source": "security-advisories@github.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-22"}]}], "descriptions": [{"lang": "en", "value": "Zoraxy is a general purpose HTTP reverse proxy and forwarding tool. Prior to version 3.3.2, an authenticated path traversal vulnerability in the configuration import endpoint allows an authenticated user to write arbitrary files outside the config directory, which can lead to RCE by creating a plugin. Version 3.3.2 patches the issue."}, {"lang": "es", "value": "Zoraxy es una herramienta de proxy inverso HTTP y reenv\u00edo de prop\u00f3sito general. Antes de la versi\u00f3n 3.3.2, una vulnerabilidad de salto de ruta autenticado en el endpoint de importaci\u00f3n de configuraci\u00f3n permite a un usuario autenticado escribir archivos arbitrarios fuera del directorio de configuraci\u00f3n, lo que puede llevar a RCE mediante la creaci\u00f3n de un plugin. La versi\u00f3n 3.3.2 corrige el problema."}], "lastModified": "2026-04-02T18:13:03.553", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:zoraxy:zoraxy:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "53E3D478-D37C-4CC6-96FF-381A55956C57", "versionEndExcluding": "3.3.2"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}