Zoraxy: 認証済みパス・トラバーサルがConfig ImportでRCEにつながる

The core of this vulnerability lies in the inadequate sanitization of zip entry names during the configuration import process. An attacker, after authenticating to the system, can craft a malicious zip file containing an entry name that bypasses the intended sanitization logic. By embedding ../ sequences within the entry name, the replacement mechanism fails to completely remove the path traversal characters, allowing the attacker to write files to arbitrary locations. This can be exploited to create a malicious plugin, effectively achieving remote code execution. The blast radius extends to the entire system, as successful exploitation grants the attacker control over the server hosting the Zoraxy instance.

Organizations utilizing Zoraxy for configuration management, particularly those with custom plugins or integrations, are at risk. Shared hosting environments where multiple users have authenticated access to the Zoraxy instance are also particularly vulnerable, as a compromised user account could be leveraged to exploit this vulnerability.

• linux / server:

find /opt/zoraxy/config -type f -name '*passwd*'

• linux / server:

journalctl -u zoraxy -g "path traversal"

• generic web:

curl -I http://your-zoraxy-instance/api/conf/import | grep -i 'content-type: multipart/form-data'

1. 2026-03-25Disclosure

   disclosure

1. 予約済み2026-03-20
2. 公開日2026-03-25
3. 更新日2026-03-27
4. EPSS 更新日2026-04-03

The primary mitigation is to immediately upgrade Zoraxy to version 3.3.2 or later, which includes the necessary fix for the path traversal vulnerability. If upgrading is not immediately feasible, consider implementing a temporary workaround by restricting write access to the configuration directory to only the Zoraxy application user. Additionally, implement strict input validation on all user-supplied data, particularly during file uploads and imports. Monitor system logs for suspicious file creation activity within the configuration directory. After upgrading, confirm the fix by attempting a configuration import with a zip file containing a deliberately malicious entry name (e.g., conf/../../../../etc/passwd) and verifying that the file is not written to the intended location.