EUVD-2026-25376Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Primary rating from GitHub Advisory · only source for this CVE.
CVSS VectorGitHub Advisory
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
8DescriptionGitHub Advisory
Roxy-WI is a web interface for managing Haproxy, Nginx, Apache and Keepalived servers. Prior to version 8.2.6.4, the oldconfig parameter in the haproxy_section_save interface has an arbitrary file read vulnerability. Version 8.2.6.4 fixes the issue.
AnalysisAI
Arbitrary file read in Roxy-WI versions before 8.2.6.4 allows unauthenticated remote attackers to access sensitive files on the server via path traversal in the oldconfig parameter of the haproxy_section_save interface. This CVSS:4.0 vector indicates zero attack complexity and no prerequisites, enabling trivial exploitation to exfiltrate configuration files, credentials, or private keys. GitHub Security Advisory confirms the vulnerability with proof-of-concept exploitation status (E:P), representing immediate risk for exposed Roxy-WI management interfaces.
Technical ContextAI
Roxy-WI is a centralized web management interface for HAProxy, Nginx, Apache, and Keepalived load balancers and proxies. The vulnerability is a CWE-22 path traversal flaw in the haproxy_section_save endpoint, where the oldconfig parameter accepts user-controlled file paths without proper validation or sanitization. Path traversal vulnerabilities allow attackers to escape intended directory boundaries using sequences like '../' to read arbitrary files accessible to the web application process. In server management tools like Roxy-WI, this typically grants access to sensitive files including /etc/passwd, SSH keys, database credentials, and configuration files containing infrastructure secrets across managed HAProxy/Nginx/Apache instances. The CPE string cpe:2.3:a:roxy-wi:roxy-wi confirms this affects the Roxy-WI application itself, not the managed proxy software.
RemediationAI
Upgrade to Roxy-WI version 8.2.6.4 or later, which contains the fix committed in https://github.com/roxy-wi/roxy-wi/commit/aecc7971959092fa93e93531f1ffcde33524b031. Organizations unable to immediately upgrade should implement compensating controls: restrict network access to the Roxy-WI management interface using firewall rules allowing only trusted administrative IP ranges or VPN subnets, eliminating the AV:N (network) attack vector. Deploy a reverse proxy with strict URL path validation to block requests containing path traversal sequences (../, %2e%2e/, etc.) to the haproxy_section_save endpoint, though this is bypass-prone and not a substitute for patching. Review web server access logs for exploitation attempts targeting the haproxy_section_save interface with suspicious file paths in the oldconfig parameter, though absence of logs does not confirm absence of compromise. These mitigations add complexity to operations and may interfere with legitimate remote management workflows, making rapid patching the preferred remediation.
The ngx_http_parse_chunked function in http/ngx_http_parse.c in nginx 1.3.9 through 1.4.0 allows remote attackers to cau
A critical vulnerability in Kubernetes ingress-nginx controller allows unauthenticated attackers with pod network access
nginx 0.8.41 through 1.4.3 and 1.5.x before 1.5.7 allows remote attackers to bypass intended restrictions via an unescap
An issue was discovered on GL.iNet devices before version 4.5.0. Rated critical severity (CVSS 9.8), this vulnerability
Nginx versions since 0.5.6 up to and including 1.13.2 are vulnerable to integer overflow vulnerability in nginx range fi
The resolver in nginx before 1.8.1 and 1.9.x before 1.9.10 allows remote attackers to cause a denial of service (invalid
Kubernetes ingress-nginx contains a configuration injection vulnerability via the mirror-target and mirror-host Ingress
A security issue was discovered in ingress-nginx https://github.com/kubernetes/ingress-nginx where the `auth-url` Ingres
A security issue was discovered in ingress-nginx https://github.com/kubernetes/ingress-nginx where the `auth-tls-match-c
Roxy-WI is a web interface for managing Haproxy, Nginx, Apache and Keepalived servers. Rated critical severity (CVSS 9.8
The STARTTLS implementation in mail/ngx_mail_smtp_handler.c in the SMTP proxy in nginx 1.5.x and 1.6.x before 1.6.1 and
Heap buffer overflow in NGINX Plus and NGINX Open Source ngx_http_rewrite_module allows remote attackers to crash worker
Same weakness CWE-22 – Path Traversal
View allSame technique Path Traversal
View allShare
External POC / Exploit Code
Leaving vuln.today