Executive brief
Roxy-WI is a management interface used to configure and control web servers like HAProxy, Nginx, and Apache. A security flaw in how the system checks user-provided text allows attackers to bypass safety filters by including specific characters like semicolons or ampersands. This can lead to serious consequences, including the ability to write malicious files to the server, steal sensitive SSH keys, or execute unauthorized commands, potentially compromising the entire infrastructure managed by the tool.
Technical details
A vulnerability exists in the EscapedString Pydantic validator within app/modules/roxywi/class_models.py. The validator uses a mutually exclusive if/elif logic flow where the presence of shell metacharacters (;, &, |, $, or backticks) triggers a 'strip' branch that returns the modified string immediately. This bypasses subsequent checks for directory traversal sequences (..) and prevents the string from being properly escaped via shlex.quote(). An authenticated attacker can exploit this by appending a metacharacter to a path traversal payload in fields such as SSH credential names or configuration versions. This can result in arbitrary file writes (e.g., writing SSH private keys to arbitrary locations) or remote code execution via downstream os.system calls. As of publication, no official patches are available.
Affected products
- Roxy-WI Roxy-WI <= 8.2.6.4
Timeline
- 2026-05-15: advisory: GitHub Security Advisory GHSA-7qm8-cm8p-9rx3 published
- 2026-06-10: disclosed: CVE-2026-45565 published to NVD