CVE-2026-33528: 
vulnerability analysis and mitigation

CVE-2026-33528 is a path traversal vulnerability in GoDoxy's file content API endpoint (/api/v1/file/content) that allows authenticated attackers with high privileges to read or write arbitrary files outside the intended config/ directory. It affects all GoDoxy versions prior to 0.27.5 (Go module github.com/yusing/godoxy). The vulnerability was published by the maintainer on March 21, 2026, added to the GitHub Advisory Database on March 24, 2026, and published by NVD on March 26, 2026. It carries a CVSS v3.1 base score of 6.5 (Medium) (GitHub Advisory, GoDoxy Advisory).

The root cause (CWE-22: Path Traversal) lies in internal/api/v1/file/get.go, where the GetPath() function passes the user-supplied filename query parameter directly to path.Join(common.ConfigBasePath, filename) without any containment check. Because ConfigBasePath is set to the relative string "config" rather than an absolute path, Go's path.Join normalizes sequences like ../certs/key.pem to certs/key.pem, effectively escaping the intended directory. The only validation applied is a non-empty field check via the binding:"required" struct tag; the format:"filename" tag is an OpenAPI/Swagger annotation only and is not enforced at runtime. Both the GET (read) and PUT (write) variants of the endpoint are affected, enabling both arbitrary file disclosure and limited file write (GitHub Advisory, GoDoxy Advisory).

A successful exploit allows a high-privileged authenticated attacker to read sensitive files accessible to the container's UID, including TLS private keys (../certs/agents/{host}.zip), OIDC OAuth refresh tokens (../data/oauth_refresh_tokens.json), and system CA certificates. Exfiltration of TLS private keys could enable impersonation of the GoDoxy server to remote agents, while stolen OAuth refresh tokens could facilitate account takeover for all active sessions. The PUT endpoint variant additionally allows writing valid YAML provider files outside config/, potentially injecting malicious route definitions and enabling further lateral movement within the proxied infrastructure (GoDoxy Advisory).

A proof-of-concept exploit consisting of concrete HTTP request steps (including the specific payload filename=../certs/secret-agent-key.pem) is publicly documented in the GitHub Security Advisory, and Feedly assesses it as a high-confidence real exploit (GoDoxy Advisory). Exploitation requires a valid authenticated session (high privileges), limiting opportunistic mass exploitation. There is no evidence of in-the-wild exploitation at this time, no known threat actor attribution, and the vulnerability is not listed in the CISA KEV catalog. The EPSS score is approximately 0.044% (14th percentile), reflecting low near-term exploitation probability (GitHub Advisory).

1. Reconnaissance: Identify internet-facing GoDoxy instances (versions ≤ 0.27.4) using Shodan, Censys, or similar tools by searching for the GoDoxy web UI or API banner on the default port (8888).
2. Authenticate: Obtain a valid session token by authenticating to the GoDoxy API (e.g., using default or compromised credentials such as admin/password) to receive a godoxy_token JWT cookie.
3. Craft traversal request: Send a GET request to the file content endpoint with a ../-prefixed filename parameter targeting a sensitive file outside config/:

GET /api/v1/file/content?type=config&filename=../certs/secret-agent-key.pem HTTP/1.1
Host: <target>:8888
Cookie: godoxy_token=<JWT>

4. Exfiltrate sensitive data: Parse the HTTP 200 response body, which returns the raw file contents (e.g., a TLS private key). Repeat with other targets such as ../data/oauth_refresh_tokens.json for OIDC tokens.
5. Optional — write malicious files: Use the PUT variant of the same endpoint with a valid YAML payload to write a provider configuration file outside config/, injecting malicious route definitions for further access (GoDoxy Advisory).

• Network: Unusual GET or PUT requests to /api/v1/file/content with filename parameters containing ../ sequences (e.g., filename=../certs/secret-agent-key.pem or filename=../data/oauth_refresh_tokens.json); URL-encoded variants such as %2E%2E%2F should also be monitored.
• Logs: GoDoxy access logs showing HTTP 200 responses to /api/v1/file/content requests with traversal patterns in the filename query parameter; unexpected content types (e.g., application/godoxy+yaml) returned for non-config files.
• File System: Unexpected YAML files appearing outside the config/ directory that match valid provider or route configuration schemas; modification timestamps on files in certs/ or data/ directories coinciding with API access events.
• Authentication: Sudden reuse of OIDC refresh tokens from new IP addresses or user agents, potentially indicating token theft via this vulnerability (GoDoxy Advisory).

Upgrade GoDoxy to version 0.27.5 or later, which resolves the vulnerability by replacing os.ReadFile with os.OpenInRoot(".", ...) to restrict file access to the application root, preventing directory traversal (GoDoxy Release, Fix Commit). If immediate upgrade is not possible, restrict network access to the GoDoxy API port (default 8888) to trusted administrators only, and rotate any TLS private keys and OAuth refresh tokens that may have been exposed. The advisory also recommends implementing path containment validation using filepath.Abs and strings.HasPrefix checks as a code-level workaround for custom deployments (GoDoxy Advisory).

The vulnerability was reported by security researcher ormzro and credited in the official GoDoxy v0.27.5 release notes (GoDoxy Release). The maintainer responded promptly, publishing the advisory and releasing a patch on the same day (March 21, 2026). No significant broader media coverage or notable social media discussion beyond automated CVE tracking feeds has been identified.