Threats affecting pkg:github/yusing/godoxy

CVE-2026-33528 is a path traversal vulnerability in yusing godoxy versions prior to 0.27.5. The vulnerability exists in the file content API endpoint at /api/v1/file/content, where the filename parameter is not properly sanitized. An authenticated attacker can exploit this to read or write files outside the intended config directory, potentially accessing sensitive files such as TLS private keys and OAuth tokens. The issue is fixed in version 0.27.5.