Roxy-WI CVE-2026-45569

Exploitation requires an authenticated session on Roxy-WI (CVSS PR:L) with permission to invoke the show_config handler, and network reachability to the management web interface. The vulnerable code path is reached by supplying a traversal sequence in the config_file_name or configver parameter - the broken patch only blocks the exact literal string '..', so any realistic payload containing '../' or '..\' bypasses the check. No user interaction is required and the vulnerability is present in the default configuration of versions 8.2.6.4 and prior, with no special features needing to be enabled. The principal limiting factor is the authentication requirement; Roxy-WI installations exposed to the public internet without network-layer restrictions and with weak account hygiene are at highest risk.

The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N, score 8.1) indicates a network-reachable, low-complexity attack that requires only low privileges and no user interaction, yielding high confidentiality and integrity impact. The vulnerability is not listed in CISA KEV and no public exploit has been identified at time of analysis, so EPSS-style mass exploitation risk is unknown but likely low at present. However, the root cause is trivially exploitable once an attacker has any authenticated session, and a one-line proof-of-concept is implicit in the published commit diff - any researcher reading the advisory can derive a working payload. The most important signal is that the vendor's existing patch is broken and no working patch exists, so defenders cannot remediate by updating; this elevates real-world risk above what raw CVSS alone suggests for instances exposed beyond trusted networks.

An attacker with any valid low-privilege Roxy-WI account - for example a junior operator or a compromised CI user - sends a request to the show_config endpoint with config_file_name set to ../../../../etc/passwd or ../../etc/haproxy/haproxy.cfg. The broken tuple-membership check returns False, the path is concatenated and read from disk, and the file contents are returned in the response, leaking system credentials, backend secrets, or HAProxy/Nginx configurations containing TLS keys. No public exploit is published yet, but the one-line commit diff makes the bypass trivially derivable.