What is the CVSS score of CVE-2026-45565?

CVE-2026-45565 has a CVSS 3.1 base score of 8.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N. EPSS exploitation probability: 0.1%.

Which versions of Roxy-WI are affected by CVE-2026-45565?

Roxy-WI versions 8.2.6.4 and earlier contain a critical path traversal and command injection vulnerability (CVSS 8.1) affecting authenticated users.

How to fix or mitigate CVE-2026-45565?

Within 24 hours: Identify all Roxy-WI deployments and verify running versions; review access logs and audit trails for suspicious administrative activity. Within 7 days: Restrict Roxy-WI administrative access to trusted networks only via firewall/VPN rules; disable unnecessary user accounts; enable detailed command execution logging. Within 30 days: Subscribe to Roxy-WI vendor security advisories; prepare for immediate patching upon release; conduct comprehensive review of all administrative account permissions.

Roxy-WI CVE-2026-45565

EUVD-2026-36062 HIGH

Improper Input Validation (CWE-20)

2026-06-10 GitHub_M

Apache Information Disclosure Nginx Roxy Wi

8.1

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.1 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Generated

Jun 10, 2026 - 16:25 vuln.today

CVE Published

Jun 10, 2026 - 15:34 nvd

HIGH 8.1

DescriptionNVD

Roxy-WI is a web interface for managing Haproxy, Nginx, Apache and Keepalived servers. In versions 8.2.6.4 and prior, EscapedString (app/modules/roxywi/class_models.py:16-30) is the centralised Pydantic validator used on dozens of fields including SSH credential name, username, description, etc. Its if/elif/elif/else flow returns the metacharacter-stripped value without also enforcing the .. block. An attacker who appends a single ;, &, |, $, or backtick to a .. payload routes the value through the strip arm, where .. survives unblocked and the result is not shlex.quote()'d either. At time of publication, there are no publicly available patches.

Articles & Coverage 3

News 9 New Nginx Vulnerabilities - 4 Critical, 5 High Severity Patched Jun 11, 2026 News 12 New Apache Vulnerabilities - 6 Critical, 6 High Severity Jun 11, 2026 News 11 New Apache Vulnerabilities - 4 Critical, 7 High Severity Jun 10, 2026

AnalysisAI

Path traversal bypass in Roxy-WI versions 8.2.6.4 and earlier allows authenticated remote attackers to escape input sanitization in the EscapedString Pydantic validator and inject shell metacharacters alongside '..' sequences. The flaw stems from a flawed if/elif/elif/else control flow that strips metacharacters without re-enforcing the '..' block, and the result is never shlex-quoted before reaching downstream command contexts. No public exploit identified at time of analysis, and no vendor-released patch identified at time of analysis.

Technical ContextAI

Roxy-WI is a Python/Flask-based web interface for managing HAProxy, Nginx, Apache, and Keepalived servers, typically deployed by network/ops teams to administer load balancers and reverse proxies. The vulnerable component is EscapedString in app/modules/roxywi/class_models.py:16-30, a centralized Pydantic validator applied to dozens of user-supplied fields including SSH credential name, username, and description. Mapped to CWE-20 (Improper Input Validation), the root cause is a control-flow defect: the validator's branches are mutually exclusive, so a payload that contains both '..' and a metacharacter such as ';', '&', '|', '$', or backtick routes through the strip arm - which removes the metacharacter but leaves the '..' traversal intact - and the sanitized output is never passed through shlex.quote() before being incorporated into shell commands. The affected CPE is cpe:2.3:a:roxy-wi:roxy-wi:*.

RemediationAI

No vendor-released patch identified at time of analysis - the advisory explicitly states no public patch exists. Monitor the upstream advisory at https://github.com/roxy-wi/roxy-wi/security/advisories/GHSA-7qm8-cm8p-9rx3 and the roxy-wi/roxy-wi repository for a fixed release and upgrade immediately when published. In the interim, restrict network access to the Roxy-WI management interface to a bastion host or VPN-only segment so the web UI is not reachable from untrusted networks (trade-off: breaks remote ops workflows that connect directly), tighten account provisioning to remove low-privilege operator accounts that are not strictly required (trade-off: reduces operational flexibility for shared teams), enforce strong unique passwords and MFA on all Roxy-WI accounts to raise the cost of the PR:L precondition, and add WAF or reverse-proxy rules in front of Roxy-WI that reject request bodies and parameters containing '..' sequences combined with ';', '&', '|', '$', or backtick characters on credential, username, and description fields (trade-off: may block legitimate values containing those characters and requires per-field tuning).