GoDoxy has a Path Traversal Vulnerability in its File API
Date: 2026-03
Affected: go/github.com/yusing/godoxy
Attack vector: path-traversal
Category: vulnerability-disclosure
Severity: Medium
CVE: CVE-2026-33528
CWE: CWE-22
CVSS: 6.5 (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N)

## Summary The file content API endpoint at `/api/v1/file/content` is vulnerable to path traversal. The `filename` query parameter is passed directly to `path.Join(common.ConfigBasePath, filename)` where `ConfigBasePath = "config"` (a relative path). No sanitization or validation is applied beyond checking that the field is non-empty (`binding:"required"`). An authenticated attacker can use `../` sequences to read or write files outside the intended `config/` directory, including TLS private keys, OAuth refresh tokens, and any file accessible to the container's UID. ## Root Cause **File:** `internal/api/v1/file/get.go`, lines 68-73: ```go func (t FileType) GetPath(filename string) string { if t == FileTypeMiddleware { return path.Join(common.MiddlewareComposeBasePath, filename) } return path.Join(common.ConfigBasePath, filename) } ``` - `common.ConfigBasePath = "config"` — relative path, not absolute - `path.Join("config", "../certs/key.pem")` normalizes to `"certs/key.pem"` — escaping `config/` - No call to `strings.HasPrefix`, `filepath.Rel`, or any containment check exists - The `format:"filename"` struct tag is an OpenAPI/Swagger annotation only, not enforced by the validator ## Proof of Concept ### Environment - GoDoxy v0.27.4 (`ghcr.io/yusing/godoxy:latest`) - Authentication enabled with default credentials (`admin`/`password`) ### Steps to Reproduce **Step 1 — Authenticate:** **Step 2 — Read file outside config/ via path traversal:** ``


Mitigations:

Architectural layers (MAESTRO):