EUVD-2026-36062Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
Lifecycle Timeline
2DescriptionNVD
Roxy-WI is a web interface for managing Haproxy, Nginx, Apache and Keepalived servers. In versions 8.2.6.4 and prior, EscapedString (app/modules/roxywi/class_models.py:16-30) is the centralised Pydantic validator used on dozens of fields including SSH credential name, username, description, etc. Its if/elif/elif/else flow returns the metacharacter-stripped value without also enforcing the .. block. An attacker who appends a single ;, &, |, $, or backtick to a .. payload routes the value through the strip arm, where .. survives unblocked and the result is not shlex.quote()'d either. At time of publication, there are no publicly available patches.
Articles & Coverage 3
AnalysisAI
Path traversal bypass in Roxy-WI versions 8.2.6.4 and earlier allows authenticated remote attackers to escape input sanitization in the EscapedString Pydantic validator and inject shell metacharacters alongside '..' sequences. The flaw stems from a flawed if/elif/elif/else control flow that strips metacharacters without re-enforcing the '..' block, and the result is never shlex-quoted before reaching downstream command contexts. No public exploit identified at time of analysis, and no vendor-released patch identified at time of analysis.
Technical ContextAI
Roxy-WI is a Python/Flask-based web interface for managing HAProxy, Nginx, Apache, and Keepalived servers, typically deployed by network/ops teams to administer load balancers and reverse proxies. The vulnerable component is EscapedString in app/modules/roxywi/class_models.py:16-30, a centralized Pydantic validator applied to dozens of user-supplied fields including SSH credential name, username, and description. Mapped to CWE-20 (Improper Input Validation), the root cause is a control-flow defect: the validator's branches are mutually exclusive, so a payload that contains both '..' and a metacharacter such as ';', '&', '|', '$', or backtick routes through the strip arm - which removes the metacharacter but leaves the '..' traversal intact - and the sanitized output is never passed through shlex.quote() before being incorporated into shell commands. The affected CPE is cpe:2.3:a:roxy-wi:roxy-wi:*.
RemediationAI
No vendor-released patch identified at time of analysis - the advisory explicitly states no public patch exists. Monitor the upstream advisory at https://github.com/roxy-wi/roxy-wi/security/advisories/GHSA-7qm8-cm8p-9rx3 and the roxy-wi/roxy-wi repository for a fixed release and upgrade immediately when published. In the interim, restrict network access to the Roxy-WI management interface to a bastion host or VPN-only segment so the web UI is not reachable from untrusted networks (trade-off: breaks remote ops workflows that connect directly), tighten account provisioning to remove low-privilege operator accounts that are not strictly required (trade-off: reduces operational flexibility for shared teams), enforce strong unique passwords and MFA on all Roxy-WI accounts to raise the cost of the PR:L precondition, and add WAF or reverse-proxy rules in front of Roxy-WI that reject request bodies and parameters containing '..' sequences combined with ';', '&', '|', '$', or backtick characters on credential, username, and description fields (trade-off: may block legitimate values containing those characters and requires per-field tuning).
The ngx_http_parse_chunked function in http/ngx_http_parse.c in nginx 1.3.9 through 1.4.0 allows remote attackers to cau
A critical vulnerability in Kubernetes ingress-nginx controller allows unauthenticated attackers with pod network access
nginx 0.8.41 through 1.4.3 and 1.5.x before 1.5.7 allows remote attackers to bypass intended restrictions via an unescap
An issue was discovered on GL.iNet devices before version 4.5.0. Rated critical severity (CVSS 9.8), this vulnerability
Nginx versions since 0.5.6 up to and including 1.13.2 are vulnerable to integer overflow vulnerability in nginx range fi
The resolver in nginx before 1.8.1 and 1.9.x before 1.9.10 allows remote attackers to cause a denial of service (invalid
Kubernetes ingress-nginx contains a configuration injection vulnerability via the mirror-target and mirror-host Ingress
A security issue was discovered in ingress-nginx https://github.com/kubernetes/ingress-nginx where the `auth-url` Ingres
A security issue was discovered in ingress-nginx https://github.com/kubernetes/ingress-nginx where the `auth-tls-match-c
Roxy-WI is a web interface for managing Haproxy, Nginx, Apache and Keepalived servers. Rated critical severity (CVSS 9.8
The STARTTLS implementation in mail/ngx_mail_smtp_handler.c in the SMTP proxy in nginx 1.5.x and 1.6.x before 1.6.1 and
Heap buffer overflow in NGINX Plus and NGINX Open Source ngx_http_rewrite_module allows remote attackers to crash worker
Same weakness CWE-20 – Improper Input Validation
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today