Threats affecting pkg:github/tobychui/zoraxy

CVE-2026-108899 is a medium severity vulnerability in tobychui zoraxy up to version 3.3.4. It involves improper authorization due to manipulation of the PathPrefix argument in the handleBasicAuth function within the Path Exception Matcher component. This flaw can be exploited remotely without authentication. An exploit has been published. Upgrading to version 3.3.5-rc1 resolves the issue.

Zoraxy versions 3.2.3 through 3.3.4 fail to properly parse IPv6 addresses in the RemoteAddr field when setting forwarded headers. Unauthenticated attackers connecting over IPv6 can supply arbitrary X-Forwarded-For values to spoof their source IP and bypass authorization provider IP-based access controls.

Zoraxy versions prior to 3.3.2 contain an authenticated path traversal vulnerability in the configuration import endpoint. This flaw allows an authenticated user to write arbitrary files outside the intended configuration directory. Exploiting this vulnerability can lead to remote code execution by creating a malicious plugin. The issue is fixed in version 3.3.2. The vulnerability has a low CVSS score of 3.3 and requires high privileges and no user interaction for exploitation.