Github.Com Tobychui Zoraxy vulnerabilities

CVE-2026-33529 [LOW] CWE-22 Zoraxy: Authenticated Path Traversal in Config Import leads to RCE Zoraxy: Authenticated Path Traversal in Config Import leads to RCE # Authenticated Path Traversal to RCE via Configuration Import ## Summary An authenticated path traversal vulnerability in the configuration import endpoint allows an authenticated user to write arbitrary files outside the config directory, which can lead to RCE by creating a plugin. ## Details The vulnerable endpoint is `POST /api

CVE-2024-52010 [HIGH] CWE-78 Zoraxy has an authenticated command injection in the Web SSH feature Zoraxy has an authenticated command injection in the Web SSH feature ### Summary A command injection vulnerability in the Web SSH feature allows an authenticated attacker to execute arbitrary commands as root on the host. ### Details Zoraxy has a Web SSH terminal feature that allows authenticated users to connect to SSH servers from their browsers. In [`HandleCreateProxySession`](https://github.co