Approved changes feed: RSS · Atom
cpe:2.3:a:yusing:godoxy:*:*:*:*:*:*:*:*part: a version: * update: *
| Vendor | Yusing (a6bbd988-3d6f-5172-8c1e-4ba0883a5ec8) |
|---|---|
| Product | Godoxy (d64d1cf1-912d-5437-a67d-7e9a67096ae4) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
Notes
Imported from gcve-enriched-dumps CVE data
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
| No PURL mappings for this CPE yet. | ||
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2026-33528 |
vulnerable | 2026-06-08 07:59:10.289816 |
GoDoxy has a Path Traversal Vulnerability in its File API
MEDIUM (6.5)
GoDoxy is a reverse proxy and container orchestrator for self-hosters. Prior to version 0.27.5, the file content API endpoint at `/api/v1/file/content` is vulnerable to path traversal. The `filename` query parameter is passed directly to `path.Join(common.ConfigBasePath, filename)` where `ConfigBasePath = "config"` (a relative path). No sanitization or validation is applied beyond checking that the field is non-empty (`binding:"required"`). An authenticated attacker can use `../` sequences to read or write files outside the intended `config/` directory, including TLS private keys, OAuth refresh tokens, and any file accessible to the container's UID. Version 0.27.5 fixes the issue.
Published: 2026-03-26T19:24:50.452Z
Updated: 2026-03-27T13:57:45.401Z |
Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.
Inspect record JSON
Open this panel to browse, search, copy or download the JSON record.