Read the docs
TI-2026-25921 Aliases CVE-2026-33528GHSA-4753-cmc8-8j9v

GoDoxy has a Path Traversal Vulnerability in its File API

Priority MEDIUM 64CWE-22Published · Updated

Key facts

Attack vector
Network
Privileges required
High
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
High · High · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub.

Summary

GoDoxy is a reverse proxy and container orchestrator for self-hosters. Prior to version 0.27.5, the file content API endpoint at `/api/v1/file/content` is vulnerable to path traversal. The `filename` query parameter is passed directly to `path.Join(common.ConfigBasePath, filename)` where `ConfigBasePath = "config"` (a relative path). No sanitization or validation is applied beyond checking that the field is non-empty (`binding:"required"`). An authenticated attacker can use `../` sequences to read or write files outside the intended `config/` directory, including TLS private keys, OAuth refresh tokens, and any file accessible to the container's UID. Version 0.27.5 fixes the issue.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.0051 43rd percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Fixed godoxy (yusing): 0.27.5github.com/yusing/godoxy (Go): 0.27.5

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
yusinggodoxybefore 0.27.50.27.5Patch availableCNA
—github.com/yusing/godoxy (Go)before 0.27.50.27.5Patch availableGHSA-4753-cmc8-8j9v
  • godoxy Vendoryusing Affected before 0.27.5 Fixed in 0.27.5 Patch available CNA
  • github.com/yusing/godoxy (Go) Vendor— Affected before 0.27.5 Fixed in 0.27.5 Patch available GHSA-4753-cmc8-8j9v

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:godoxy:godoxy:*:*:*:*:*:go:*:*before 0.27.5VulnerableGodoxy
  • cpe:2.3:a:godoxy:godoxy:*:*:*:*:*:go:*:* Versions before 0.27.5 Vulnerable ·Godoxy

Remediation

  • Fix · CNA godoxy (yusing) Fixed in 0.27.5
  • Fix · GHSA-4753-cmc8-8j9v github.com/yusing/godoxy (Go) Fixed in 0.27.5 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-33528
  2. 2026-10-03 Alias added: GHSA-4753-cmc8-8j9v

References

Exploit 1

Patch 1

Advisory 1

Other 2

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences