Which versions of Roxy-WI are affected by EUVD-2026-25375?

Roxy-WI versions before 8.2.6.4 contain an unauthenticated remote code execution vulnerability that allows attackers to manipulate scheduled tasks and achieve arbitrary command execution on…. A patch is available.

How to fix or mitigate EUVD-2026-25375?

Within 24 hours: Identify all Roxy-WI instances in your environment and document current versions. Within 7 days: Immediately upgrade to Roxy-WI 8.2.6.4 or later if available; if unavailable, implement network segmentation restricting unauthenticated access to the haproxy_section_save interface. Within 30 days: Conduct forensic review of logs for the haproxy_section_save endpoint dating back 90 days; perform integrity checks on all scheduled tasks and cron job configurations across managed infrastructure.

Roxy-WI EUVD-2026-25375

Q: What is the CVSS score of EUVD-2026-25375?

EUVD-2026-25375 has a CVSS 4.0 base score of 8.9 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.5%.

| CVE-2026-33076 HIGH

Path Traversal (CWE-22)

2026-04-24 GitHub_M

RCE Apache Path Traversal Nginx Roxy Wi

8.9

CVSS 4.0 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

8.9 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Patch released

Apr 27, 2026 - 15:03 nvd

Patch available

Re-analysis Queued

Apr 24, 2026 - 14:52 vuln.today

cvss_changed

Patch available

Apr 24, 2026 - 05:01 EUVD

Analysis Generated

Apr 24, 2026 - 03:30 vuln.today

CVSS changed

Apr 24, 2026 - 03:22 NVD

8.9 (HIGH)

EUVD ID Assigned

Apr 24, 2026 - 03:00 euvd

EUVD-2026-25375

Analysis Generated

Apr 24, 2026 - 03:00 vuln.today

CVE Published

Apr 24, 2026 - 01:52 nvd

HIGH 8.9

DescriptionGitHub Advisory

Roxy-WI is a web interface for managing Haproxy, Nginx, Apache and Keepalived servers. Prior to version 8.2.6.4, the haproxy_section_save interface presents a vulnerability that could lead to remote code execution due to path traversal and writing into scheduled tasks. Version 8.2.6.4 fixes the issue.

AnalysisAI

Remote code execution in Roxy-WI versions before 8.2.6.4 allows unauthenticated attackers to write malicious code into scheduled tasks via path traversal in the haproxy_section_save interface. The vulnerability chains CWE-22 path traversal with cron job manipulation, enabling arbitrary command execution on servers managing HAProxy, Nginx, Apache, and Keepalived infrastructure. CVSS 8.9 with network attack vector and no privileges required indicates critical risk, though EPSS data and KEV status are unavailable to confirm active exploitation.

Technical ContextAI

Roxy-WI is a centralized web interface for managing reverse proxy and load balancer configurations (HAProxy, Nginx, Apache) and high-availability services (Keepalived). The vulnerability affects the haproxy_section_save API endpoint, which processes configuration file paths without proper sanitization (CWE-22: Improper Limitation of a Pathname to a Restricted Directory). Attackers can exploit directory traversal sequences (e.g., '../../../') to escape intended configuration directories and write attacker-controlled content to system locations, specifically targeting cron job files or scheduled task directories. Once malicious entries are written to cron, the system's task scheduler executes the injected commands with application or system privileges, achieving persistent remote code execution. The affected CPE (cpe:2.3:a:roxy-wi:roxy-wi:*:*:*:*:*:*:*:*) indicates all versions prior to 8.2.6.4 are vulnerable.

RemediationAI

Upgrade to Roxy-WI version 8.2.6.4 or later, which contains the security fix implemented in commit aecc7971959092fa93e93531f1ffcde33524b031 (https://github.com/roxy-wi/roxy-wi/commit/aecc7971959092fa93e93531f1ffcde33524b031). Review GitHub security advisory GHSA-mmgm-p9x9-h33j for complete remediation guidance. If immediate patching is not feasible, implement network-level access controls to restrict the Roxy-WI web interface to trusted management networks only - configure firewall rules to block internet access and permit connections exclusively from authorized administrator IP ranges or VPN endpoints. Disable the haproxy_section_save API endpoint if HAProxy configuration management through this interface is not actively required, though this may break configuration workflows. Monitor system cron jobs and scheduled tasks for unauthorized entries, particularly in /etc/cron.d/, /var/spool/cron/, and user crontabs - establish file integrity monitoring on these directories. Audit application logs for suspicious haproxy_section_save API calls containing path traversal sequences (../, encoded variants). Note that network restrictions significantly reduce attack surface but do not eliminate insider threat or pivot-after-breach scenarios; patching remains the primary mitigation.