Executive brief
Roxy-WI is a management interface used to configure and control web servers like HAProxy, Nginx, and Apache. A security flaw allows an authenticated user with standard permissions to execute unauthorized commands on the underlying server. This could lead to a complete system takeover, unauthorized access to sensitive configuration data, or disruption of managed web services.
Technical details
An OS command injection vulnerability exists in Roxy-WI versions 8.2.6.4 and prior within the 'save_version' route. The application takes the 'configver' parameter from the URL path and interpolates it directly into a string passed to 'os.system()' for the 'dos2unix' command. Because the parameter is not validated by Pydantic or sanitized via 'EscapedString', and a previous security patch for path traversal was insufficient, an authenticated user (role level 3 or lower) can use shell metacharacters (e.g., ';', '&', '|') to execute arbitrary commands as the web server user. At the time of reporting, no official patch is available, though manual remediation involves switching to 'subprocess.run' with argument arrays and implementing regex-based input validation.
Affected products
- Roxy-WI Roxy-WI <= 8.2.6.4
Timeline
- 2026-05-15: advisory: GitHub Security Advisory published
- 2026-06-10: disclosed: CVE published to NVD