CVE-2026-45564: Roxy-WI Command Injection in Configuration Version Parameter (CVSS 8.8)

Technical summary

The vulnerability exists in the POST /config/versions/<service>/<server_ip>/<configver>/save endpoint. The 'configver' path parameter is concatenated directly into a shell command passed to os.system() without sanitization: dos2unix -q {cfg}. Roxy-WI uses Pydantic for validation but does not enforce escaped string constraints on path parameters declared as plain strings. The developers had previously attempted a patch using tuple-membership validation (GHSA-vapt-004), but this was ineffective. An authenticated attacker can include shell metacharacters (pipe, semicolon, backtick, etc.) in the configver parameter to break out of the intended command and execute arbitrary system commands. The vulnerability is classified under CWE-78 (Improper Neutralization of Special Elements used in an OS Command).

Business impact

Compromise of any Roxy-WI instance grants an attacker the ability to execute arbitrary commands on the underlying server with the same privileges as the web application process. This can lead to data exfiltration, installation of persistence mechanisms, lateral movement to managed Haproxy/Nginx/Apache/Keepalived nodes, and disruption of load-balancing and web infrastructure. For organizations relying on Roxy-WI to manage critical proxy and web services, this represents a path to infrastructure takeover. The requirement for authentication limits exposure to insider threats and compromised accounts, but does not eliminate risk—especially in environments where service accounts or shared credentials are common.

Affected systems

Roxy-WI versions 8.2.6.4 and prior are affected. No vendor product data was available at publication, but any deployment of Roxy-WI in this version range is at risk. Organizations should inventory all instances and verify the installed version. Check release notes and the vendor's official repository to determine if a patched version has been released since the initial publication date of June 10, 2026.

Exploitability

The attack requires valid authentication credentials and a role assignment of 3 or lower (standard user privileges), making it a post-authentication attack rather than unauthenticated. However, in many environments, user-level accounts are numerous and may be shared, delegated, or compromised via phishing or credential theft. Once authenticated, the attack is trivial to execute—no advanced exploitation techniques are required. The CVSS 3.1 score of 8.8 (HIGH) reflects the low attack complexity, low privilege requirements, and complete impact across all three security dimensions (confidentiality, integrity, availability). Active exploitation is plausible if Roxy-WI is exposed to untrusted networks or if internal user accounts are compromised.

Remediation

At the time of publication (June 10, 2026), no official patches were available. Organizations must take interim action: (1) Restrict access to Roxy-WI to trusted networks only, using firewall rules or VPN gateways. (2) Limit user account creation and enforce strong, unique passwords; audit active user accounts and role assignments. (3) Monitor authentication logs for suspicious login patterns. (4) Upgrade to a patched version as soon as the vendor releases one—verify against the official vendor advisory and release notes. (5) Consider air-gapping the Roxy-WI instance or running it in a restricted security zone until patched.

Patch guidance

Verify the vendor's official GitHub repository and release notes for a patched version greater than 8.2.6.4. Apply the patch to all Roxy-WI instances in your environment, testing in a non-production environment first to ensure compatibility with your Haproxy, Nginx, Apache, and Keepalived configurations. The patch must address input validation in the configver parameter, ensuring that all user-supplied path components are properly escaped before being passed to os.system() or, preferably, replaced with a safer subprocess method that avoids shell interpretation.

Detection guidance

Monitor web server and application logs for POST requests to /config/versions/*/*/*/save endpoints where the configver parameter contains shell metacharacters (semicolon, pipe, backtick, dollar-parenthesis, newline, etc.). Look for authentication logs showing user accounts with role 3 or lower accessing Roxy-WI, especially from unusual source IPs or at odd times. Check system logs on the Roxy-WI host for unexpected process execution, particularly dos2unix invocations with suspicious arguments. Use endpoint detection and response (EDR) tools to monitor for child processes spawned by the Roxy-WI application. Consider deploying a Web Application Firewall (WAF) rule to block requests with encoded or raw shell metacharacters in path parameters.

Why prioritize this

This vulnerability merits immediate attention because it combines post-authentication command injection with a low privilege threshold (standard users), high impact across all security dimensions, and the current absence of a public patch. Any Roxy-WI instance managing production load-balancers or critical web infrastructure is a high-value target. Organizations should prioritize patching as soon as a fix becomes available, and in the interim, implement strong access controls and network segmentation around Roxy-WI instances.

Risk score, explained

The CVSS 3.1 score of 8.8 (HIGH) reflects: Network-based attack vector (AV:N), low attack complexity (AC:L), low privilege requirements (PR:L), no user interaction needed (UI:N), and unchanged scope (S:U). The impact is complete across confidentiality, integrity, and availability (C:H, I:H, A:H), meaning an attacker can read, modify, or delete data, and disrupt services. Although authentication is required, the low privilege bar and ease of exploitation elevate the overall risk.

Frequently asked questions