Skip to content
Heist/ feed
Back to feed
Medium

GoDoxy has a Path Traversal Vulnerability in its File API

Type: advisorySources: OSV

GoDoxy is a reverse proxy and container orchestrator for self-hosters. Prior to version 0.27.5, the file content API endpoint at `/api/v1/file/content` is vulnerable to path traversal. The `filename` query parameter is passed directly to `path.Join(common.ConfigBasePath, filename)` where `ConfigBasePath = "config"` (a relative path). No sanitization or validation is applied beyond checking that the field is non-empty (`binding:"required"`). An authenticated attacker can use `../` sequences to read or write files outside the intended `config/` directory, including TLS private keys, OAuth refresh tokens, and any file accessible to the container's UID. Version 0.27.5 fixes the issue.

Products
Not specified
Affected versions
Not specified
Fixed versions
Not specified
CVEs
CVE-2026-33528
Confirmed fixed CVEs
Not specified
Updated in this feed
5 Nov 2026, 03:29 UTC · Revision 1

Source evidence

GoDoxy has a Path Traversal Vulnerability in its File API

core-osv · Original source

Published 26 Mar 2026, 19:24 UTC

GoDoxy is a reverse proxy and container orchestrator for self-hosters. Prior to version 0.27.5, the file content API endpoint at `/api/v1/file/content` is vulnerable to path traversal. The `filename` query parameter is passed directly to `path.Join(common.ConfigBasePath, filename)` where `ConfigBasePath = "config"` (a relative path). No sanitization or validation is applied beyond checking that the field is non-empty (`binding:"required"`). An authenticated attacker can use `../` sequences to read or write files outside the intended `config/` directory, including TLS private keys, OAuth refresh tokens, and any file accessible to the container's UID. Version 0.27.5 fixes the issue.

osv:CVE-2026-33528
Complete source record
{
  "id": "da92ee58072ab41c877011f5508c65c4192c12cbde580a9928e17331d56c15e7",
  "url": "https://osv.dev/vulnerability/CVE-2026-33528",
  "method": "structured",
  "payload": {
    "kind": "advisory",
    "title": "GoDoxy has a Path Traversal Vulnerability in its File API",
    "summary": "GoDoxy is a reverse proxy and container orchestrator for self-hosters. Prior to version 0.27.5, the file content API endpoint at `/api/v1/file/content` is vulnerable to path traversal. The `filename` query parameter is passed directly to `path.Join(common.ConfigBasePath, filename)` where `ConfigBasePath = \"config\"` (a relative path). No sanitization or validation is applied beyond checking that the field is non-empty (`binding:\"required\"`). An authenticated attacker can use `../` sequences to read or write files outside the intended `config/` directory, including TLS private keys, OAuth refresh tokens, and any file accessible to the container's UID. Version 0.27.5 fixes the issue.",
    "evidence": "osv:CVE-2026-33528",
    "products": [],
    "severity": "medium",
    "structured": {
      "id": "CVE-2026-33528",
      "aliases": [
        "CVE-2026-33528",
        "GHSA-4753-cmc8-8j9v",
        "GO-2026-4817"
      ],
      "metrics": [
        {
          "type": "CVSS_V3",
          "score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N"
        }
      ],
      "affected": [
        {
          "ranges": [
            {
              "repo": "https://github.com/yusing/godoxy",
              "type": "GIT",
              "events": [
                {
                  "introduced": "0"
                },
                {
                  "fixed": "11e3a9231f23d365d4bd58c25d3c87ea8b04a151"
                },
                {
                  "fixed": "a541d75bb50f1b542c096d8bc8082c3549f5c059"
                }
              ],
              "database_specific": {
                "extracted_events": [
                  {
                    "cpe": "cpe:2.3:a:godoxy:godoxy:*:*:*:*:*:go:*:*",
                    "range": [
                      {
                        "introduced": "0"
                      },
                      {
                        "fixed": "0.27.5"
                      }
                    ],
                    "source": "CPE_RANGE"
                  },
                  {
                    "range": [
                      {
                        "fixed": "a541d75bb50f1b542c096d8bc8082c3549f5c059"
                      }
                    ],
                    "source": "REFERENCES_COMMIT"
                  },
                  {
                    "range": [
                      {
                        "fixed": "11e3a9231f23d365d4bd58c25d3c87ea8b04a151"
                      }
                    ],
                    "source": "REFERENCES_TAG",
                    "original_tag": "v0.27.5"
                  }
                ]
              }
            }
          ],
          "versions": [
            "v0.27.4",
            "v0.27.3",
            "v0.27.2",
            "v0.27.1",
            "v0.27.0",
            "v0.26.0",
            "v0.25.3",
            "v0.25.2",
            "v0.25.1",
            "v0.25.0",
            "v0.24.3",
            "v0.24.2",
            "v0.24.1",
            "v0.24.0",
            "v0.23.1",
            "v0.23.0",
            "v0.22.1",
            "v0.22.0",
            "v0.21.3",
            "v0.21.2",
            "v0.21.1",
            "v0.21.0",
            "v0.20.14",
            "v0.20.13",
            "v0.20.12",
            "v0.20.11",
            "v0.20.10",
            "v0.20.9",
            "v0.20.8",
            "v0.20.7",
            "v0.20.6",
            "v0.20.5",
            "v0.20.4",
            "v0.20.3",
            "v0.20.2",
            "v0.20.1",
            "v0.20.0",
            "v0.19.2",
            "v0.19.1",
            "v0.19.0",
            "v0.18.6",
            "v0.18.5",
            "v0.18.4",
            "v0.18.3",
            "v0.18.2",
            "v0.18.1",
            "v0.18.0",
            "v0.17.6",
            "v0.17.5",
            "v0.17.4",
            "v0.17.3",
            "v0.17.2",
            "v0.17.1",
            "v0.17.0",
            "v0.16.2",
            "v0.16.1",
            "v0.16.0-pathfix",
            "v0.16.0",
            "v0.15.3",
            "v0.15.1",
            "v0.15.0",
            "v0.14.2",
            "v0.14.1",
            "v0.14.0",
            "v0.13.8",
            "v0.13.7",
            "v0.13.6",
            "v0.13.5",
            "v0.13.4",
            "v0.13.3",
            "v0.13.2",
            "v0.13.1",
            "v0.13.0",
            "v0.12.3",
            "v0.12.2",
            "v0.12.1",
            "v0.12.0",
            "v0.11.9",
            "v0.11.8",
            "v0.11.7",
            "v0.11.6-buildfix",
            "v0.11.6",
            "v0.11.5",
            "v0.11.4",
            "v0.11.3",
            "v0.11.2-2",
            "v0.11.2-1",
            "v0.11.2",
            "v0.11.1",
            "v0.11.0",
            "v0.10.2",
            "v0.10.1",
            "v0.10.0",
            "v0.9.10",
            "v0.9.9-1",
            "v0.9.9",
            "v0.9.8",
            "0.9.8",
            "0.9.7",
            "0.9.6",
            "0.9.5",
            "0.9.4-1",
            "0.9.4",
            "0.9.3",
            "0.9.2",
            "0.9.1",
            "0.9",
            "0.8.1",
            "0.8.0",
            "0.7.7",
            "0.7.6",
            "0.7.5",
            "0.7.4",
            "0.7.3",
            "0.7.2",
            "0.7.1",
            "0.7.0",
            "0.6.4-1",
            "0.6.4",
            "0.6.2",
            "0.6.1",
            "0.6",
            "0.6-rp1",
            "0.5.8",
            "0.5.7",
            "0.5.6",
            "0.5.5",
            "0.5.4",
            "0.5.3",
            "0.5.2",
            "0.5.1",
            "0.5.0",
            "0.5.0-rc6",
            "0.5.0-rc5",
            "0.5.0-rc4",
            "0.5.0-rc3",
            "0.5.0-rc2",
            "0.5.0-rc1",
            "0.5.0-beta3",
            "0.5.0-beta2",
            "0.5.0-beta",
            "0.4.8",
            "0.4.7",
            "0.4.6",
            "0.4.5",
            "0.4.4",
            "0.4.3",
            "0.4.2",
            "0.4.1",
            "0.4.0",
            "0.3.1",
            "0.3",
            "0.2.2",
            "0.2.1",
            "0.2-alpha",
            "0.1-stable"
          ],
          "database_specific": {
            "source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-33528.json"
          }
        }
      ],
      "modified": "2026-10-28T02:30:42.339817450Z",
      "provider": "osv",
      "references": [
        "https://github.com/yusing/godoxy/releases/tag/v0.27.5",
        "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/33xxx/CVE-2026-33528.json",
        "https://github.com/yusing/godoxy/security/advisories/GHSA-4753-cmc8-8j9v",
        "https://nvd.nist.gov/vuln/detail/CVE-2026-33528",
        "https://github.com/yusing/godoxy/commit/a541d75bb50f1b542c096d8bc8082c3549f5c059"
      ],
      "provider_metadata": {
        "cwe_ids": [
          "CWE-22"
        ],
        "cna_assigner": "GitHub_M",
        "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/33xxx/CVE-2026-33528.json"
      }
    },
    "related_cves": [
      {
        "value": "CVE-2026-33528",
        "evidence": "/id"
      }
    ],
    "security_relevant": true,
    "severity_evidence": "/severity/0/score"
  },
  "source_id": "core-osv",
  "document_id": 509847,
  "published_at": "2026-03-26T19:24:50.452+00:00"
}