CVE-2026-33529

CVE-2026-33529 details an authenticated path traversal vulnerability in Zoraxy, an HTTP reverse proxy, affecting versions prior to 3.3.2. This flaw allows an authenticated user to write arbitrary files outside the config directory, potentially leading to Remote Code Execution (RCE) by creating a malicious plugin. With a CVSS score of 8.8 (High), the vulnerability has a network attack vector and low attack complexity, requiring only low privileges for exploitation. While it is on an active "Hot List" and has seen limited community discussion, there is currently no public exploit code available, and it is not listed in CISA's Known Exploited Vulnerabilities (KEV) catalog.