Tobychui vulnerabilities
We track 4 vulnerabilities in Tobychui products. 4 are rated high or critical, and none are known to be exploited. The most recent was published on October 12, 2026.
Latest Tobychui vulnerabilities
- 7.3 High severity
zoraxy: Incorrect Privilege Assignment
A flaw has been found in tobychui zoraxy up to 3.3.4. This impacts the function handleBasicAuth of the file mod/dynamicproxy/authProviders.go of the component Path Exception Matcher. This manipulation of the argument PathPrefix causes improper authorization. I
- 7.4 High severity
zoraxy: Authentication Bypass by Spoofing
Zoraxy versions 3.2.3 through 3.3.4 fail to properly parse IPv6 addresses in the RemoteAddr field when setting forwarded headers. Unauthenticated attackers connecting over IPv6 can supply arbitrary X-Forwarded-For values to spoof their source IP and bypass aut
- 8.8 High severity
zoraxy: Improper Limitation of a Pathname to a Restricted Directory
Zoraxy is a general purpose HTTP reverse proxy and forwarding tool. Prior to version 3.3.2, an authenticated path traversal vulnerability in the configuration import endpoint allows an authenticated user to write arbitrary files outside the config directory, w
- 8.6 High severity
zoraxy: Improper Neutralization of Special Elements used in an OS Command
Zoraxy is a general purpose HTTP reverse proxy and forwarding tool. A command injection vulnerability in the Web SSH feature allows an authenticated attacker to execute arbitrary commands as root on the host. Zoraxy has a Web SSH terminal feature that allows a