# CVE-2026-45556: Roxy-WI authenticated arbitrary file write in WAF rule save

Source: https://junglewise.ai/threats/cve-2026-45556-roxy-wi-authenticated-arbitrary-file-write-in-waf-rule-save  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-06-10. Updated: 2026-06-10  
License: CC BY 4.0 with a link back

CVE-2026-45556 · Severity: critical · CVSS 9.9 · Published 2026-06-10

Roxy-WI is a management platform used to configure and control load balancers like Nginx and HAProxy. A security flaw allows an authorized user to write malicious files to any location on the managed load balancer servers. By placing a malicious script in a system folder, an attacker can take complete control of the load balancer, potentially leading to data theft or service disruption across the entire network infrastructure.

Technologies: [Roxy-WI](https://junglewise.ai/threats/technologies/roxy-wi). Vendors: [Roxy-WI](https://junglewise.ai/threats/vendors/roxy-wi).

## Quick answers

**Is CVE-2026-45556 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-45556 being exploited in the wild.

**How severe is CVE-2026-45556?** Critical severity, with a CVSS score of 9.9, published 10 June 2026.

**Which products and versions are affected?** Roxy-WI <= 8.2.6.4.

**Is there a fix for CVE-2026-45556?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-45556 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-45556?** Check whether you run Roxy-WI at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A path traversal and improper input validation vulnerability exists in the WAF rule saving functionality of Roxy-WI. The 'config_file_name' parameter in the POST request to '/waf/<service>/<server_ip>/rule/<rule_id>/save' is insufficiently validated; while it checks for substrings like 'nginx' or 'cfg' and forbids '..', it performs a character substitution (92 to /) that allows an attacker to specify absolute paths. Because Roxy-WI moves these files on the target load balancer using sudo, an attacker can drop files into sensitive directories like /etc/cron.d/. This allows for remote code execution (RCE) as the root user on any managed load balancer. The vulnerability requires 'group admin' (level 2) privileges. As of the advisory date, no patches are available.

## Affected products

- Roxy-WI Roxy-WI <= 8.2.6.4

## Timeline

- 2026-05-15: advisory: GitHub Security Advisory published
- 2026-06-10: disclosed: CVE published to NVD

## References

- [https://github.com/roxy-wi/roxy-wi/security/advisories/GHSA-85gm-773v-x7m4](https://github.com/roxy-wi/roxy-wi/security/advisories/GHSA-85gm-773v-x7m4)

## Related threats

- [Roxy-WI path traversal in configuration management](https://junglewise.ai/threats/cve-2026-45569-roxy-wi-path-traversal-in-configuration-management)
- [Roxy-WI authentication bypass via URL substring manipulation](https://junglewise.ai/threats/cve-2026-45567-roxy-wi-authentication-bypass-via-url-substring-manipulation)
- [Roxy-WI open redirect in login flow via userinfo syntax bypass](https://junglewise.ai/threats/cve-2026-45566-roxy-wi-open-redirect-in-login-flow-via-userinfo-syntax-bypass)
- [Roxy-WI input validation bypass in EscapedString validator](https://junglewise.ai/threats/cve-2026-45565-roxy-wi-input-validation-bypass-in-escapedstring-validator)
- [Roxy-WI command injection in config versions save route](https://junglewise.ai/threats/cve-2026-45564-roxy-wi-command-injection-in-config-versions-save-route)