Which versions of Roxy-WI are affected by CVE-2026-33077?

Roxy-WI versions before 8.2.6.4 contain an unauthenticated path traversal vulnerability enabling remote attackers to read arbitrary files, including configuration files and credentials, from affected…. A patch is available.

How to fix or mitigate CVE-2026-33077?

Within 24 hours: Identify all Roxy-WI instances in your environment and document their version numbers and network exposure. Within 7 days: Implement network-level access controls restricting Roxy-WI management interfaces to trusted IP ranges only; apply input validation blocking path traversal sequences (../, ..\ ) on the oldconfig parameter. Within 30 days: Upgrade Roxy-WI to version 8.2.6.4 or later when available; if upgrade is not feasible, maintain network segmentation and consider replacing the management interface with an alternative HAProxy management tool.

Roxy-WI CVE-2026-33077

Q: What is the CVSS score of CVE-2026-33077?

CVE-2026-33077 has a CVSS 4.0 base score of 7.7 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-25376 HIGH

Path Traversal (CWE-22)

2026-04-24 GitHub_M

Apache Path Traversal Nginx Roxy Wi

7.7

CVSS 4.0 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

7.7 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Patch released

Apr 27, 2026 - 15:04 nvd

Patch available

Re-analysis Queued

Apr 24, 2026 - 14:52 vuln.today

cvss_changed

Patch available

Apr 24, 2026 - 05:01 EUVD

Analysis Generated

Apr 24, 2026 - 03:30 vuln.today

CVSS changed

Apr 24, 2026 - 03:22 NVD

7.7 (HIGH)

EUVD ID Assigned

Apr 24, 2026 - 03:00 euvd

EUVD-2026-25376

Analysis Generated

Apr 24, 2026 - 03:00 vuln.today

CVE Published

Apr 24, 2026 - 01:55 nvd

HIGH 7.7

DescriptionGitHub Advisory

Roxy-WI is a web interface for managing Haproxy, Nginx, Apache and Keepalived servers. Prior to version 8.2.6.4, the oldconfig parameter in the haproxy_section_save interface has an arbitrary file read vulnerability. Version 8.2.6.4 fixes the issue.

AnalysisAI

Arbitrary file read in Roxy-WI versions before 8.2.6.4 allows unauthenticated remote attackers to access sensitive files on the server via path traversal in the oldconfig parameter of the haproxy_section_save interface. This CVSS:4.0 vector indicates zero attack complexity and no prerequisites, enabling trivial exploitation to exfiltrate configuration files, credentials, or private keys. GitHub Security Advisory confirms the vulnerability with proof-of-concept exploitation status (E:P), representing immediate risk for exposed Roxy-WI management interfaces.

Technical ContextAI

Roxy-WI is a centralized web management interface for HAProxy, Nginx, Apache, and Keepalived load balancers and proxies. The vulnerability is a CWE-22 path traversal flaw in the haproxy_section_save endpoint, where the oldconfig parameter accepts user-controlled file paths without proper validation or sanitization. Path traversal vulnerabilities allow attackers to escape intended directory boundaries using sequences like '../' to read arbitrary files accessible to the web application process. In server management tools like Roxy-WI, this typically grants access to sensitive files including /etc/passwd, SSH keys, database credentials, and configuration files containing infrastructure secrets across managed HAProxy/Nginx/Apache instances. The CPE string cpe:2.3:a:roxy-wi:roxy-wi confirms this affects the Roxy-WI application itself, not the managed proxy software.

RemediationAI

Upgrade to Roxy-WI version 8.2.6.4 or later, which contains the fix committed in https://github.com/roxy-wi/roxy-wi/commit/aecc7971959092fa93e93531f1ffcde33524b031. Organizations unable to immediately upgrade should implement compensating controls: restrict network access to the Roxy-WI management interface using firewall rules allowing only trusted administrative IP ranges or VPN subnets, eliminating the AV:N (network) attack vector. Deploy a reverse proxy with strict URL path validation to block requests containing path traversal sequences (../, %2e%2e/, etc.) to the haproxy_section_save endpoint, though this is bypass-prone and not a substitute for patching. Review web server access logs for exploitation attempts targeting the haproxy_section_save interface with suspicious file paths in the oldconfig parameter, though absence of logs does not confirm absence of compromise. These mitigations add complexity to operations and may interfere with legitimate remote management workflows, making rapid patching the preferred remediation.