Which versions of Roxy-WI are affected by CVE-2026-33208?

Roxy-WI versions before 8.2.6.4 contain a command injection vulnerability allowing authenticated users to execute arbitrary commands with elevated privileges on managed infrastructure servers,…. A patch is available.

How to fix or mitigate CVE-2026-33208?

Within 24 hours: Inventory all Roxy-WI deployments and document current versions. Within 7 days: Apply vendor-released patch 8.2.6.4 (available via GitHub commit 02f147d) to all instances; if immediate patching is not feasible, restrict access to the /config/ /find-in-config endpoint via firewall or web application controls. Within 30 days: Conduct audit of low-privileged user accounts with Roxy-WI access and implement least-privilege principle; review audit logs for exploitation indicators.

Roxy-WI CVE-2026-33208

Q: What is the CVSS score of CVE-2026-33208?

CVE-2026-33208 has a CVSS 4.0 base score of 7.4 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.4%.

EUVD-2026-25378 HIGH

OS Command Injection (CWE-78)

2026-04-24 GitHub_M

RCE Apache Command Injection Nginx Roxy Wi

7.4

CVSS 4.0 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

7.4 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Patch released

Apr 27, 2026 - 15:16 nvd

Patch available

Re-analysis Queued

Apr 24, 2026 - 14:52 vuln.today

cvss_changed

Patch available

Apr 24, 2026 - 05:01 EUVD

Analysis Generated

Apr 24, 2026 - 03:31 vuln.today

CVSS changed

Apr 24, 2026 - 03:22 NVD

7.4 (HIGH)

EUVD ID Assigned

Apr 24, 2026 - 03:00 euvd

EUVD-2026-25378

Analysis Generated

Apr 24, 2026 - 03:00 vuln.today

CVE Published

Apr 24, 2026 - 02:10 nvd

HIGH 7.4

DescriptionGitHub Advisory

Roxy-WI is a web interface for managing Haproxy, Nginx, Apache and Keepalived servers. Prior to version 8.2.6.4, the /config/ < service > /find-in-config endpoint in Roxy-WI fails to sanitize the user-supplied words parameter before embedding it into a shell command string that is subsequently executed on a remote managed server via SSH. An authenticated attacker can inject arbitrary shell metacharacters to break out of the intended grep command context and execute arbitrary OS commands with sudo privileges on the target server, resulting in full Remote Code Execution (RCE). Version 8.2.6.4 patches the issue.

AnalysisAI

Command injection in Roxy-WI versions prior to 8.2.6.4 enables authenticated attackers to execute arbitrary OS commands with sudo privileges on managed servers. The vulnerability stems from unsanitized input in the /config/<service>/find-in-config endpoint that breaks out of grep command context during remote SSH execution. A proof-of-concept exploit exists (CVSS E:P), and the CVSS 4.0 score of 7.4 reflects network-based attack with low complexity requiring only low-privilege authentication. Vendor-released patch 8.2.6.4 available via GitHub commit 02f147d.

Technical ContextAI

Roxy-WI is a web-based management interface for Haproxy, Nginx, Apache, and Keepalived servers that executes administrative commands on remote managed servers via SSH. The vulnerability affects the configuration search functionality where the 'words' parameter is passed unsanitized into a shell command string containing grep. This constitutes a classic CWE-78 OS Command Injection flaw where shell metacharacters (such as semicolons, pipes, backticks, or command substitution syntax) can terminate the intended grep command and inject arbitrary commands. The commands execute with sudo privileges in the context of the SSH session on the target managed server, not just the Roxy-WI web application host. The CPE identifier cpe:2.3:a:roxy-wi:roxy-wi indicates all versions prior to the patched release are affected.

RemediationAI

Upgrade immediately to Roxy-WI version 8.2.6.4 or later, which contains input sanitization fixes per GitHub commit 02f147d567a3cc8cf61a4b58ea4c2b7866a544de available at https://github.com/roxy-wi/roxy-wi/commit/02f147d567a3cc8cf61a4b58ea4c2b7866a544de. If immediate patching is not feasible, implement these compensating controls: Restrict network access to the Roxy-WI management interface to trusted administrator IP addresses only via firewall rules or reverse proxy ACLs (trade-off: reduces operational flexibility for remote administration). Audit and minimize Roxy-WI user accounts, removing low-privilege users and enforcing strong authentication (trade-off: may impact team workflows requiring delegated access). Monitor SSH logs on managed servers for unexpected command patterns or privilege escalation attempts originating from Roxy-WI's SSH keys (trade-off: detection-only, does not prevent exploitation). Consider temporarily disabling the configuration search feature if not operationally critical until patching is complete (trade-off: loss of search functionality).