CVE-2026-33528

GoDoxy is a reverse proxy and container orchestrator for self-hosters. Prior to version 0.27.5, the file content API endpoint at `/api/v1/file/content` is vulnerable to path traversal. The `filename` query parameter is passed directly to `path.Join(common.ConfigBasePath, filename)` where `ConfigBasePath = "config"` (a relative path). No sanitization or validation is applied beyond checking that the field is non-empty (`binding:"required"`). An authenticated attacker can use `../` sequences to read or write files outside the intended `config/` directory, including TLS private keys, OAuth refresh tokens, and any file accessible to the container's UID. Version 0.27.5 fixes the issue.

• CWE-22

• https://github.com/yusing/godoxy/commit/a541d75bb50f1b542c096d8bc8082c3549f5c059Patch
• https://github.com/yusing/godoxy/releases/tag/v0.27.5Product, Release Notes
• https://github.com/yusing/godoxy/security/advisories/GHSA-4753-cmc8-8j9vExploit, Mitigation, Vendor Advisory
• https://github.com/yusing/godoxy/security/advisories/GHSA-4753-cmc8-8j9vExploit, Mitigation, Vendor Advisory

Published

Mar 26, 2026

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-3352The Easy PHP Settings plugin for WordPress is vulnerable to …7.2
• CVE-2026-33523HTTP response splitting vulnerability in multiple Apache HTT…6.5
• CVE-2026-33524Zserio is a framework for serializing structured data with a…7.5
• CVE-2026-33525Authelia is an open-source authentication and authorization …6.1
• CVE-2026-33526Squid is a caching proxy for the Web. Prior to version 7.5, …7.5
• CVE-2026-33527Parse Server is an open source backend that can be deployed …4.3
• CVE-2026-33529Zoraxy is a general purpose HTTP reverse proxy and forwardin…8.8
• CVE-2026-3353The Comment SPAM Wiper plugin for WordPress is vulnerable to…4.4
• CVE-2026-33530InvenTree is an Open Source Inventory Management System. Pri…6.5
• CVE-2026-33531InvenTree is an Open Source Inventory Management System. Pri…6.5
• CVE-2026-33532`yaml` is a YAML parser and serialiser for JavaScript. Parsi…4.3
• CVE-2026-33533Glances is an open-source system cross-platform monitoring t…6.5