Apache
CVE-2026-27811
HIGH
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate to Roxy-WI interface
-
ExploitAccess config compare endpoint with malicious payload
-
ExecutionInject system command in server_ip parameter
-
ImpactExecute arbitrary command on host
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Command injection prevention
MITRE ATT&CK
1 technique across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires authenticated user access to Roxy-WI versions prior to 8.2.6.3. Attacker must POST crafted input to |
| Impact | The CVSS vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H indicates this is a network-exploitable vulnerability with low attack complexity requiring only low-level authentication, no user interaction, and resulting in high impact to confidentiality, integrity, and availability. While the 8.8 score reflects significant technical severity, the practical risk is moderated by the authentication requirement (PR:L) which limits exposure to users with existing credentials on the Roxy-WI platform. No EPSS score or KEV listing data is provided in the available intelligence, suggesting no known active exploitation in the wild at this time. The vulnerability is automatable once credentials are obtained and provides complete system compromise capabilities. Organizations running Roxy-WI should prioritize patching given that a fix is available in version 8.2.6.3, as the command injection class (CWE-77) is frequently exploited when discovered and authentication barriers can be overcome through credential compromise, phishing, or insider threats. |
| Exploit ScenarioDerived | An authenticated attacker with low-level user credentials logs into the Roxy-WI web interface and crafts a malicious request to the /config/compare/<service>/<server_ip>/show endpoint, injecting shell metacharacters and commands into the server_ip parameter or other user-controlled inputs. Because the application directly formats this input into a command template string without sanitization (line 362 of config.py), the attacker's injected commands execute on the underlying system with the privileges of the application process, allowing them to exfiltrate sensitive configuration data, modify server settings, establish persistence mechanisms, pivot to managed infrastructure, or completely compromise the Roxy-WI host. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Mar 18, 2026
Roxy-WI versions prior to 8.2.6.3 contain a command injection vulnerability in the configuration comparison endpoint that allows authenticated users to execute arbitrary system commands on the host server. The flaw stems from unsanitized user input being directly embedded into template strings executed by the application. An attacker with valid credentials can exploit this to achieve full system compromise with high impact on confidentiality, integrity, and availability.
Earlier versions of this analysis (1)
A command injection vulnerability in Roxy-WI web interface allows authenticated users with low privileges to execute arbitrary system commands on the application host through the /config/compare/<service>/<server_ip>/show endpoint. Roxy-WI is a management interface for Haproxy, Nginx, Apache and Keepalived servers, and versions prior to 8.2.6.3 are affected. The vulnerability scores 8.8 CVSS v3.1 due to its network accessibility, low attack complexity, and high impact across confidentiality, integrity and availability, though it requires authentication.
RemediationAI
Upgrade Roxy-WI to version 8.2.6.3 or later, which contains a fix for the command injection vulnerability as documented in the release notes at https://github.com/roxy-wi/roxy-wi/releases/tag/v8.2.6.3. The specific patch commit addressing this issue can be reviewed at https://github.com/roxy-wi/roxy-wi/commit/a10ac7306c252014f97a7213db4a9470300fa064. Until patching is complete, consider implementing compensating controls such as restricting network access to the Roxy-WI management interface to trusted IP ranges only, enforcing strong authentication policies, conducting audit log reviews for suspicious activity on the vulnerable endpoint, and applying principle of least privilege for user accounts. Full details are available in the GitHub Security Advisory at https://github.com/roxy-wi/roxy-wi/security/advisories/GHSA-jvmv-cw47-jh77.
Affected ProductsAI
Roxy-WI web interface versions prior to 8.2.6.3 are affected by this command injection vulnerability. Roxy-WI is an open-source web management platform for Haproxy, Nginx, Apache and Keepalived servers developed by roxy-wi. The vulnerability was disclosed through GitHub Security Advisories (GHSA-jvmv-cw47-jh77) and confirmed by the project maintainers. The issue impacts all deployments running vulnerable versions regardless of which managed service (Haproxy, Nginx, Apache, or Keepalived) is being configured through the interface.
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
This vulnerability is classified as CWE-77 (Improper Neutralization of Special Elements used in a Command), a command injection flaw. The issue exists in app/modules/config/config.py at line 362 where user-supplied input is directly incorporated into a template string that is subsequently executed as a system command without proper sanitization or validation. Command injection occurs when an application passes unsafe user-supplied data to a system shell, allowing attackers to append malicious commands using shell metacharacters. Roxy-WI is a Python-based web application that provides centralized management for popular web servers and load balancers including Haproxy, Nginx, Apache, and Keepalived.
Know when Nginx gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Primary rating from GitHub Advisory · only source for this CVE.
CVSS VectorGitHub Advisory
DescriptionGitHub Advisory
Roxy-WI is a web interface for managing Haproxy, Nginx, Apache and Keepalived servers. Prior to version 8.2.6.3, a command injection vulnerability exists in the /config/compare/<service>/<server_ip>/show endpoint, allowed authenticated users to execute arbitrary system commands on the app host. The vulnerability exists in app/modules/config/config.py on line 362, where user input is directly formatted in the template string that is eventually executed. Version 8.2.6.3 fixes the issue.
Executive ViewAI
Roxy-WI versions prior to 8.2.6.3 contain a critical command injection vulnerability allowing authenticated users to execute arbitrary commands on infrastructure management servers. This directly threatens operational security for organizations managing HAProxy, Nginx, Apache, and Keepalived through Roxy-WI, potentially enabling attackers to compromise critical load balancing and web server infrastructure.
Implement Web Application Firewall (WAF) rules to detect and block command injection patterns (shell metacharacters, command substitution syntax) targeting /config/compare/ endpoint; disable the config compare feature entirely if operationally feasible; restrict network access to Roxy-WI to trusted administrative networks only using firewall rules; implement strict input validation at the application layer; require multi-factor authentication for all Roxy-WI users; monitor system command execution logs for suspicious activity from the Roxy-WI service account.
Threat Intelligence Overview
NVD
CVE.org
EPSS
GitHub
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
OS command injection occurs when an application passes unsanitized user input directly into system shell commands.
Related Vulnerabilities in Network Device Command/TFTP Injection
View all 2Denial of service against HTTP/2 server implementations allows remote unauthenticated attackers to exhaust server resour
The ngx_http_parse_chunked function in http/ngx_http_parse.c in nginx 1.3.9 through 1.4.0 allows remote attackers to cau
A critical vulnerability in Kubernetes ingress-nginx controller allows unauthenticated attackers with pod network access
nginx 0.8.41 through 1.4.3 and 1.5.x before 1.5.7 allows remote attackers to bypass intended restrictions via an unescap
An issue was discovered on GL.iNet devices before version 4.5.0. Rated critical severity (CVSS 9.8), this vulnerability
Nginx versions since 0.5.6 up to and including 1.13.2 are vulnerable to integer overflow vulnerability in nginx range fi
The resolver in nginx before 1.8.1 and 1.9.x before 1.9.10 allows remote attackers to cause a denial of service (invalid
Kubernetes ingress-nginx contains a configuration injection vulnerability via the mirror-target and mirror-host Ingress
A security issue was discovered in ingress-nginx https://github.com/kubernetes/ingress-nginx where the `auth-url` Ingres
A security issue was discovered in ingress-nginx https://github.com/kubernetes/ingress-nginx where the `auth-tls-match-c
Roxy-WI is a web interface for managing Haproxy, Nginx, Apache and Keepalived servers. Rated critical severity (CVSS 9.8
The STARTTLS implementation in mail/ngx_mail_smtp_handler.c in the SMTP proxy in nginx 1.5.x and 1.6.x before 1.6.1 and
Exploit-DB