PT-2026-48460 · Roxy-Wi · Roxy-Wi

Published 2026-06-10 · Updated 2026-06-10 · CVE-2026-45569

Mitre

CVSS v3.1

8.1

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

Roxy-WI is a web interface for managing Haproxy, Nginx, Apache and Keepalived servers. In versions 8.2.6.4 and prior, ommit d4d10006 ("Expand validation to block .. in config file name and configver for improved security") added a line in app/modules/config/config.py:462. This is tuple-membership, not substring containment — '..' in (a, b, c) evaluates to True only if any of a, b, c is equal to the literal string '..'. For any realistic path-traversal payload (../../etc/passwd, ....etcpasswd, etc.) the check returns False and the patch silently lets the payload through. At time of publication, there are no publicly available patches.

Fix

Path traversal

Weakness Enumeration

CWE-697

CWE-22

Related Identifiers

CVE-2026-45569

Affected Products

Roxy-Wi

References · 3

• https://nvd.nist.gov/vuln/detail/CVE-2026-45569 · Security Note
• https://github.com/roxy-wi/roxy-wi/security/advisories/GHSA-j6p4-8532-h9hv · Note
• https://github.com/roxy-wi/roxy-wi/commit/d4d10006 · Note