What is the CVSS score of EUVD-2026-36065?

EUVD-2026-36065 has a CVSS 3.1 base score of 8.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N. EPSS exploitation probability: 0.0%.

Which versions of Roxy-WI are affected by EUVD-2026-36065?

Roxy-WI versions 8.2.6.4 and earlier contain a path traversal vulnerability allowing authenticated remote attackers to read arbitrary configuration files.

How to fix or mitigate EUVD-2026-36065?

24 hours: Inventory all Roxy-WI deployments running version 8.2.6.4 or earlier and document their network exposure and user base. 7 days: Implement network segmentation and access controls to limit authenticated users to necessary functions; increase audit logging of configuration file access. 30 days: No vendor-released patch identified at time of analysis-contact vendor for security update timeline; prepare upgrade or replacement strategy for affected systems.

Roxy-WI EUVD-2026-36065

| CVE-2026-45569 HIGH

Path Traversal (CWE-22)

2026-06-10 GitHub_M

Apache Path Traversal Nginx Roxy Wi

8.1

CVSS 3.1 · Vendor: GitHub_M

Severity by source

Vendor (GitHub_M) PRIMARY

8.1 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

Primary rating from Vendor (GitHub_M) · only source for this CVE.

CVSS VectorVendor: GitHub_M

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

None

Lifecycle Timeline

Source Code Evidence Fetched

Jun 10, 2026 - 16:23 vuln.today

Analysis Generated

Jun 10, 2026 - 16:23 vuln.today

CVE Published

Jun 10, 2026 - 15:38 nvd

HIGH 8.1

DescriptionCVE.org

Roxy-WI is a web interface for managing Haproxy, Nginx, Apache and Keepalived servers. In versions 8.2.6.4 and prior, ommit d4d10006 ("Expand validation to block .. in config_file_name and configver for improved security") added a line in app/modules/config/config.py:462. This is tuple-membership, not substring containment - '..' in (a, b, c) evaluates to True only if any of a, b, c is equal to the literal string '..'. For any realistic path-traversal payload (../../etc/passwd, ..\\..\\etc\\passwd, etc.) the check returns False and the patch silently lets the payload through. At time of publication, there are no publicly available patches.

Articles & Coverage 3

News 9 New Nginx Vulnerabilities - 4 Critical, 5 High Severity Patched Jun 11, 2026 News 12 New Apache Vulnerabilities - 6 Critical, 6 High Severity Jun 11, 2026 News 11 New Apache Vulnerabilities - 4 Critical, 7 High Severity Jun 10, 2026

AnalysisAI

Path traversal in Roxy-WI versions 8.2.6.4 and prior allows authenticated remote attackers to read arbitrary configuration files via the config_file_name and configver parameters. The vendor's attempted fix in commit d4d10006 is ineffective due to a logic error - it uses Python tuple-membership instead of substring containment - leaving all realistic '../' payloads unblocked, with no public exploit identified at time of analysis.

Technical ContextAI

Roxy-WI is a Python-based web management interface for HAProxy, Nginx, Apache, and Keepalived. The flaw resides in app/modules/config/config.py:462 within the show_config() function, classified as CWE-22 (Improper Limitation of a Pathname to a Restricted Directory). The defective patch wrote if '..' in (configs_dir, config_file_name, configver):, which is a tuple-membership test that only returns True when one of those variables equals the literal two-character string '..' - not when any of them contains '..' as a substring. As a result, payloads such as ../../etc/passwd or ..\..\etc\passwd bypass the check entirely. Affected CPE: cpe:2.3:a:roxy-wi:roxy-wi:*:*:*:*:*:*:*:*.

RemediationAI

No vendor-released patch identified at time of analysis - the published commit d4d10006 contains a logic bug and does not block traversal sequences. Operators should monitor https://github.com/roxy-wi/roxy-wi/security/advisories/GHSA-j6p4-8532-h9hv for a corrected fix that uses substring containment (e.g., if any('..' in p for p in (configs_dir, config_file_name, configver))) or a proper path-canonicalization check. Until a real patch ships, compensating controls include placing Roxy-WI behind a VPN or IP allowlist to remove network reachability, adding a reverse-proxy WAF rule that rejects requests containing '..', '%2e%2e', or backslash sequences in config_file_name and configver parameters (side effect: may break legitimate requests with unusual filenames), restricting authenticated Roxy-WI accounts to trusted operators only since PR:L is required, and tightening filesystem permissions on the Roxy-WI service account so it cannot read sensitive files like /etc/passwd, /etc/shadow, or backend service credentials (side effect: may interfere with legitimate config-management features).