Is CVE-2026-45565 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-45565 being exploited in the wild.

How severe is CVE-2026-45565?

High severity, with a CVSS score of 8.1, published 10 June 2026.

Is there a fix for CVE-2026-45565?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-45565 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2026-45565?

Check whether you run Roxy-WI at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-45565: Roxy-WI input validation bypass in EscapedString validator

CVE-2026-45565 · Severity: high · CVSS 8.1 · Published 2026-06-10

Roxy-WI is a management interface used to configure and control web servers like HAProxy, Nginx, and Apache. A security flaw in how the system checks user-provided text allows attackers to bypass safety filters by including specific characters like semicolons or ampersands. This can lead to serious consequences, including the ability to write malicious files to the server, steal sensitive SSH keys, or execute unauthorized commands, potentially compromising the entire infrastructure managed by the tool.

Technologies: Roxy-WI. Vendors: Roxy-WI.

Quick answers

Is CVE-2026-45565 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-45565 being exploited in the wild.
How severe is CVE-2026-45565?: High severity, with a CVSS score of 8.1, published 10 June 2026.
Which products and versions are affected?: Roxy-WI <= 8.2.6.4.
Is there a fix for CVE-2026-45565?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-45565 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-45565?: Check whether you run Roxy-WI at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A vulnerability exists in the EscapedString Pydantic validator within app/modules/roxywi/class_models.py. The validator uses a mutually exclusive if/elif logic flow where the presence of shell metacharacters (;, &, |, $, or backticks) triggers a 'strip' branch that returns the modified string immediately. This bypasses subsequent checks for directory traversal sequences (..) and prevents the string from being properly escaped via shlex.quote(). An authenticated attacker can exploit this by appending a metacharacter to a path traversal payload in fields such as SSH credential names or configuration versions. This can result in arbitrary file writes (e.g., writing SSH private keys to arbitrary locations) or remote code execution via downstream os.system calls. As of publication, no official patches are available.

Affected products

Roxy-WI Roxy-WI <= 8.2.6.4

Timeline

2026-05-15: advisory: GitHub Security Advisory GHSA-7qm8-cm8p-9rx3 published
2026-06-10: disclosed: CVE-2026-45565 published to NVD

References

https://github.com/roxy-wi/roxy-wi/security/advisories/GHSA-7qm8-cm8p-9rx3

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.