PT-2026-25962 · Apache+4 · Apache+4

Flocto

·

Published

2026-03-17

·

Updated

2026-03-19

·

CVE-2026-27811

CVSS v3.1

8.8

High

VectorAV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Name of the Vulnerable Software and Affected Versions Roxy-WI versions prior to 8.2.6.3
Description Roxy-WI is a web interface used for managing Haproxy, Nginx, Apache, and Keepalived servers. A command injection issue exists in the /config/compare/<service>/<server ip>/show endpoint, allowing authenticated users to execute arbitrary system commands on the application host. The issue is located in app/modules/config/config.py on line 362, where user input is directly formatted into a template string that is subsequently executed. The vulnerable parameter is the service and server ip within the API endpoint.
Recommendations Upgrade to version 8.2.6.3 or later to resolve this issue.

Exploit

Fix

RCE

Command Injection

OS Command Injection

Found an issue in the description? Have something to add? Feel free to write us 👾
dbugs@ptsecurity.com

Weakness Enumeration

CWE-77CWE-78

Related Identifiers

CVE-2026-27811
GHSA-JVMV-CW47-JH77

Affected Products

Apache
Haproxy
Keepalived
Nginx
Roxy-Wi