Chasingimpact

**Name of the Vulnerable Software and Affected Versions** Roxy-WI versions prior to 8.2.8.2 **Description** Roxy-WI, a web interface for managing Haproxy, Nginx, Apache and Keepalived servers, contains a command injection issue in the log viewing functionality. Authenticated users can execute arbitrary system commands due to unsanitized input used with the `grep` parameter in `app/modules/roxywi/logs.py` line 87. The parameter is used both sanitized and raw, creating the opportunity for exploitation. **Recommendations** Upgrade to Roxy-WI version 8.2.8.2 or later.