An authenticated path traversal flaw in Zoraxy’s configuration import endpoint allows an attacker who can log in to write arbitrary files outside the intended configuration directory. By creating a malicious plugin file, the compromised system can execute arbitrary code on the host. The vulnerability is a classic directory traversal issue identified as CWE‑22.

The flaw impacts all releases of Zoraxy by tobychui prior to version 3.3.2, including v3.3.1 and earlier builds. Service operators must verify whether their installations are running a vulnerable build and whether the configuration import interface is enabled.

The CVSS score is 3.3, indicating low severity, and the EPSS score is less than 1 %, suggesting a low probability of exploitation. The vulnerability is not listed in the CISA KEV catalog. Successful exploitation requires an authenticated user who can access the configuration import endpoint; once the attacker can move the path to write outside the config directory, they can register a plugin that will be executed by the application. The likely attack vector is authenticated use of the configuration import feature, and while the chance of widespread attacks is currently low, the potential impact remains significant.