Zoraxy: Authenticated Path Traversal in Config Import leads to RCE
Date: 2026-03
Affected: go/github.com/tobychui/zoraxy
Attack vector: path-traversal
Category: vulnerability-disclosure
Severity: Low
CVE: CVE-2026-33529
CWE: CWE-22
CVSS: 3.3 (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:L/A:N)

# Authenticated Path Traversal to RCE via Configuration Import ## Summary An authenticated path traversal vulnerability in the configuration import endpoint allows an authenticated user to write arbitrary files outside the config directory, which can lead to RCE by creating a plugin. ## Details The vulnerable endpoint is `POST /api/conf/import`. The zip entry names sanitization is bypassed by embedding `../` inside a longer sequence so the replacement produces a new `../`: ``` conf/..././..././entrypoint.py → ReplaceAll("../", "") (match found at index 1 of "..././", leaving "../") → conf/../../entrypoint.py ← passes HasPrefix check, escapes conf/ ``` Using this endpoint, a new plugin can be written (persistent) and the entrypoint (non-persistent) can be edited to add execution permissions to the plugin. When the database is provided in the import, the program should exit to trigger a container restart (which does not happen because the entrypoint does not monitor the Zoraxy exit code). As a result, the container was manually restarted for the PoC to work. ## PoC ```python import argparse import io import json import re import sys import zipfile import requests import urllib3 urllib3.disable_warnings(urllib3.exceptions.InsecureRequestWarning) INTRO_SPEC_JSON = json.dumps({ "id": "com.attacker.evil", "name": "System Updater", "author": "System", "author_contact": "", "description": "Internal system update module", "url": "", "ui_p


Mitigations:

Architectural layers (MAESTRO):