PT-2026-3072 · Apache+4 · Apache+4

Chasingimpact · Published 2026-01-15 · Updated 2026-02-18 · CVE-2026-22265

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Roxy-WI versions prior to 8.2.8.2

Description Roxy-WI, a web interface for managing Haproxy, Nginx, Apache and Keepalived servers, contains a command injection issue in the log viewing functionality. Authenticated users can execute arbitrary system commands due to unsanitized input used with the grep parameter in app/modules/roxywi/logs.py line 87. The parameter is used both sanitized and raw, creating the opportunity for exploitation.

Recommendations Upgrade to Roxy-WI version 8.2.8.2 or later.

Exploit

Fix

OS Command Injection

Weakness Enumeration

CWE-78

Related Identifiers

CVE-2026-22265

GHSA-MMMF-VH7M-RM47

Affected Products

Apache

Haproxy

Keepalived

Nginx

Roxy-Wi

References · 8

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/22xxx/CVE-2026-22265.json · Exploit
• https://github.com/roxy-wi/roxy-wi/security/advisories/GHSA-mmmf-vh7m-rm47 · Vendor Advisory
• https://github.com/roxy-wi/roxy-wi/commit/f040d3338c4ba6f66127487361592e32e0188eee · Patch
• https://osv.dev/vulnerability/CVE-2026-22265 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-22265 · Security Note
• https://github.com/roxy-wi/roxy-wi/releases/tag/v8.2.8.2 · Note
• https://t.me/cveNotify/152376 · Telegram Post
• https://twitter.com/CVEnew/status/2011926084326212016 · Twitter Post