Roxy Wi EUVD-2026-23966

Exploitation requires valid authentication credentials to access the Roxy-WI web interface. The vulnerable POST /config/<service>/show endpoint must be accessible over the network. There are no additional non-default configuration requirements-the vulnerability is present in standard deployments. The attacker must know or guess the base directory path structure, but common paths (/config/, /etc/, etc.) are easily inferred or disclosed by error messages. Exploitation is limited to files readable by the web application process user (typically www-data or similar); system files requiring elevated privileges are generally inaccessible.

The CVSS 4.0 vector (AV:N/AC:L/PR:L) indicates network-accessible, low-complexity, authenticated exploitation with high confidentiality impact but no integrity or availability impact. The E:P (exploit proof-of-concept) flag suggests exploitation evidence exists. Real-world risk is moderate to moderately-high: authentication is required, limiting exposure to users with legitimate access or compromised credentials, but once authenticated, exploitation is trivial (path traversal via common ../ patterns requires minimal skill). The CVSS score of 5.7 reflects this-meaningful impact (arbitrary file read) but mitigated by the authentication prerequisite. No KEV status is provided, so active widespread exploitation is not confirmed, but the simplicity of the exploit and the sensitive nature of configuration files accessible to web applications (database credentials, API keys, private keys) make this a practical post-compromise or insider threat scenario. Organizations managing critical infrastructure via Roxy-WI should prioritize patching to prevent unauthorized information disclosure.

An authenticated attacker logs into Roxy-WI with valid credentials (or obtains credentials through phishing or credential compromise). They craft a POST request to /config/nginx/show with a configver parameter like ../../../etc/passwd to traverse out of the intended config directory and read the system password file. The server returns the file contents in the response. By iterating with different traversal paths (../../../var/www/html/.env, ../../../etc/ssl/private/key.pem, etc.), the attacker can systematically extract sensitive files such as database credentials, API keys, and TLS private keys.