Executive brief
Roxy-WI is a management platform used to configure and control load balancers like Nginx and HAProxy. A security flaw allows an authorized user to write malicious files to any location on the managed load balancer servers. By placing a malicious script in a system folder, an attacker can take complete control of the load balancer, potentially leading to data theft or service disruption across the entire network infrastructure.
Technical details
A path traversal and improper input validation vulnerability exists in the WAF rule saving functionality of Roxy-WI. The 'config_file_name' parameter in the POST request to '/waf/<service>/<server_ip>/rule/<rule_id>/save' is insufficiently validated; while it checks for substrings like 'nginx' or 'cfg' and forbids '..', it performs a character substitution (92 to /) that allows an attacker to specify absolute paths. Because Roxy-WI moves these files on the target load balancer using sudo, an attacker can drop files into sensitive directories like /etc/cron.d/. This allows for remote code execution (RCE) as the root user on any managed load balancer. The vulnerability requires 'group admin' (level 2) privileges. As of the advisory date, no patches are available.
Affected products
- Roxy-WI Roxy-WI <= 8.2.6.4
Timeline
- 2026-05-15: advisory: GitHub Security Advisory published
- 2026-06-10: disclosed: CVE published to NVD