CVE-2026-33529: 
NixOS vulnerability analysis and mitigation

CVE-2026-33529 is an authenticated path traversal vulnerability ("Zip Slip") in Zoraxy, a general-purpose HTTP reverse proxy and forwarding tool, affecting all versions prior to 3.3.2. The flaw exists in the configuration import endpoint and allows any authenticated user to write arbitrary files outside the intended config directory, which can be chained to achieve remote code execution (RCE) by planting a malicious plugin. It was disclosed by researcher JakePeralta7 and published to the GitHub Advisory Database on March 24, 2026, with the NVD entry following on March 26, 2026. The Feedly threat intelligence data assigns a CVSS v3.1 base score of 8.8 (High), while the GitHub Security Advisory itself rates it 3.3 (Low) using a more conservative vector — practitioners should weigh both assessments (GitHub Advisory, Zoraxy Advisory).

The root cause is CWE-22 (Improper Limitation of a Pathname to a Restricted Directory — Path Traversal). The vulnerable endpoint is POST /api/conf/import, which accepts a ZIP archive and extracts its contents. The original sanitization used strings.ReplaceAll(name, "../", "") followed by a strings.HasPrefix(name, "conf/") check; an attacker bypasses both by embedding ../ inside a longer sequence such as conf/..././..././entrypoint.py — after the replacement removes the inner ../, the result resolves to conf/../../entrypoint.py, which escapes the conf/ directory. The fix in commit 69ac755 replaces the naive string replacement with filepath.Clean plus an absolute-path boundary check to ensure extracted files cannot escape the target directory (Zoraxy Advisory, Patch Commit).

Successful exploitation allows any authenticated user to write arbitrary files anywhere on the host filesystem accessible to the Zoraxy process, leading to full RCE. The most impactful attack path involves overwriting the container entrypoint (entrypoint.py) and planting a persistent malicious plugin (/opt/zoraxy/plugin/evil/start.sh) that executes attacker-controlled commands on container restart. If the Docker socket is mapped into the container — a common deployment pattern — this vulnerability can escalate to complete host takeover, compromising confidentiality, integrity, and availability of the underlying system (GitHub Advisory, Zoraxy Advisory).

A complete, runnable Python proof-of-concept exploit is publicly available in the GitHub Security Advisory, implementing the full attack chain: authentication, config export, malicious ZIP construction, and upload (Zoraxy Advisory). The exploit requires valid credentials (low-privilege authenticated access), making it accessible to any user with a Zoraxy account. The EPSS score is approximately 0.041% (low probability of near-term exploitation), and there is no evidence of active in-the-wild exploitation or CISA KEV catalog listing as of the time of this report. Qualys has added detection for this vulnerability (detection ID 761875) (Feedly).

1. Obtain credentials: Acquire valid Zoraxy credentials (any authenticated user account suffices).
2. Retrieve CSRF token: Send a GET request to {host}/login.html and extract the zoraxy.csrf.Token meta tag value from the response.
3. Authenticate: POST credentials to {host}/api/auth/login with the CSRF token in the X-CSRF-Token header to establish an authenticated session.
4. Export live configuration: Send a GET request to {host}/api/conf/export?includeDB=true to obtain a valid baseline ZIP archive of the current configuration.
5. Build malicious ZIP: Modify the exported ZIP to include two traversal-path entries:
   • conf/..././..././entrypoint.py — a malicious Python entrypoint that executes the attacker's command and sets up the plugin.
   • conf/..././..././plugin/evil/start.sh — a shell script plugin that runs the payload when invoked by Zoraxy.
6. Upload malicious ZIP: POST the crafted ZIP to {host}/api/conf/import with the CSRF token. The server's flawed sanitization resolves the traversal paths, writing files outside conf/ (e.g., overwriting /opt/zoraxy/entrypoint.py and creating /opt/zoraxy/plugin/evil/start.sh).
7. Trigger execution: Restart the Zoraxy container (manually or by including the database in the import to prompt an exit). On restart, the overwritten entrypoint executes the attacker's command, achieving RCE (Zoraxy Advisory).

• Network: Authenticated POST requests to /api/conf/import with a ZIP payload significantly larger than a normal config backup; GET requests to /api/conf/export?includeDB=true immediately followed by a POST to /api/conf/import from the same session.
• File System: Unexpected or modified entrypoint.py at /opt/zoraxy/entrypoint.py with unusual content (e.g., subprocess.run calls with attacker commands); presence of /opt/zoraxy/plugin/evil/ directory or any newly created plugin directory not provisioned by the administrator; files with 0o755 permissions set programmatically on plugin scripts.
• Logs: Zoraxy access logs showing POST /api/conf/import with large request bodies; log entries with Restoring: lines referencing paths containing .. or paths outside the conf/ directory (visible in application stdout before the patch).
• Process: Unexpected child processes spawned by the Zoraxy or entrypoint Python process (e.g., sh -c <attacker_command>, curl, wget, reverse shell processes); unusual outbound network connections from the Zoraxy container to external IPs (Zoraxy Advisory).

Upgrade Zoraxy to version 3.3.2 or later, which fixes the path traversal by replacing the naive ReplaceAll sanitization with filepath.Clean and an absolute-path boundary check in src/config.go (Patch Commit, v3.3.2 Release). As an interim workaround if immediate upgrade is not possible, restrict access to the configuration import endpoint (POST /api/conf/import) to trusted administrator accounts only, and audit existing user accounts for unauthorized access. Additionally, avoid mapping the Docker socket into the Zoraxy container to limit the blast radius of any exploitation (Zoraxy Advisory).

The vulnerability was reported by researcher JakePeralta7 and published by the Zoraxy maintainer (tobychui) on March 24, 2026. A Bluesky post from the CVE tracking account noted the disclosure shortly after publication. Coverage appeared on threat intelligence aggregators including vulnerability.circl.lu, radar.offseq.com, and infinitsec.net, as well as INCIBE-CERT's early warning system. No major vendor statements beyond the GitHub advisory or significant broader media coverage have been identified (Zoraxy Advisory).