Skip to content
Patch Next
Sign inAdd to your agent

← Public intelligence

Go package

github.com/yusing/godoxy

Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.

Open advisories

1 actionable advisory, newest first. Withdrawn advisories and news are excluded. Coverage is partial.

  1. Medium, CVSS 6.5GoPublished

    GoDoxy has a Path Traversal Vulnerability in its File API

    CVE-2026-33528 · GHSA-4753-cmc8-8j9v

    Affected
    • Go github.com/yusing/godoxy < 0.27.5
    Fixed in
    0.27.5· Vendor fix available
    Issue
    The file content API endpoint at /api/v1/file/content is vulnerable to path traversal. The filename query parameter is passed directly to path.Join(common.ConfigBasePath, filename) where ConfigBasePath = "config" (a relative path). No sanitization or validation is applied beyond checking that the field is non-empty (binding:"required"). An authenticated attacker can use ../ sequences to read or write files outside the intended config/ directory, including TLS private keys, OAuth refresh tokens, and any file accessible to the container's UID. Root Cause File: internal/api/v1/file/get.go, lines 68-73: - common.ConfigBasePath = "config" — relative path, not absolute - path.Join("config", "../certs/key.pem") normalizes to "certs/key.pem" — escaping config/ - No call to strings.HasPrefix, filepath.Rel, or any containment check exists - The format:"filename" struct tag is an OpenAPI/Swagger annotation only, not enforced by the validator Proof of Concept Environment - GoDoxy v0.27.4…

    Recommended action: Upgrade to 0.27.5 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.

    Sources:github.comSource checked Evidence →