Roxy-WI EUVD-2026-36062

The attacker must hold valid low-privileged credentials to the Roxy-WI web interface (CVSS PR:L) and reach it over the network (AV:N), and must submit input through one of the dozens of fields routed through the EscapedString Pydantic validator in app/modules/roxywi/class_models.py - confirmed examples include SSH credential name, username, and description. The exploit payload must contain a '..' traversal sequence together with at least one of the metacharacters ';', '&', '|', '$', or backtick, which is what triggers the strip arm of the validator's if/elif/elif/else flow and lets the '..' survive unblocked into a downstream shell context that does not apply shlex.quote(). No user interaction is required (UI:N), no non-default configuration is needed, and any Roxy-WI instance at 8.2.6.4 or earlier is in scope; the primary limiter on real-world exploitation is the authenticated-user requirement and whether the management interface is exposed beyond the operations network.

The CVSS 3.1 score of 8.1 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N) reflects a network-reachable, low-complexity flaw requiring low-privilege authentication, with high confidentiality and integrity impact but no availability impact. Because Roxy-WI is a server-management console, PR:L authentication is a realistic prerequisite - any registered operator account is sufficient, and these systems are often shared across ops teams. EPSS and KEV data were not provided in the input; the vulnerability is not listed in CISA KEV and no public exploit has been identified at time of analysis, so this is currently a defensive-priority issue rather than confirmed mass-exploitation. The combination of authenticated path traversal plus unquoted shell parameter injection across 'dozens of fields' substantially raises the realistic blast radius beyond a typical CWE-20 finding, and the absence of a vendor patch elevates urgency for self-hosted deployments.

An attacker with a low-privileged Roxy-WI operator account submits a crafted value such as 'name;../../../../etc/shadow' to a field validated by EscapedString - for example an SSH credential name or description. The validator's strip branch removes the trailing ';' but leaves '../../../../etc/shadow' intact, and because the result is not shlex-quoted it is interpolated into a downstream shell command that reads or operates on the path, exposing sensitive files or letting the attacker overwrite configuration consumed by the managed HAProxy/Nginx/Apache/Keepalived backends. No public exploit identified at time of analysis, but the bug pattern is described in enough detail in the advisory to make reproduction straightforward.