PT-2026-34834 · Roxy-Wi · Roxy-Wi

Published 2026-04-24 · Updated 2026-04-24 · CVE-2026-33077

NVD

CVSS v4.0

7.7

High

AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Roxy-WI is a web interface for managing Haproxy, Nginx, Apache and Keepalived servers. Prior to version 8.2.6.4, the oldconfig parameter in the haproxy section save interface has an arbitrary file read vulnerability. Version 8.2.6.4 fixes the issue.

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2026-33077

Affected Products

Roxy-Wi

References · 3

• https://nvd.nist.gov/vuln/detail/CVE-2026-33077 · Security Note
• https://github.com/roxy-wi/roxy-wi/security/advisories/GHSA-c799-4ww6-q93w · Note
• https://github.com/roxy-wi/roxy-wi/commit/aecc7971959092fa93e93531f1ffcde33524b031 · Note