CVE-2026-45565: Roxy-WI Path Traversal & Shell Injection in Input Validation

Technical summary

The vulnerability resides in the EscapedString Pydantic validator (app/modules/roxywi/class_models.py:16-30), which is responsible for sanitizing input across multiple configuration fields. The validator's if/elif/elif/else control flow strips certain metacharacters (;, &, |, $, backtick) but does not properly block path traversal sequences (..). When an attacker appends a metacharacter to a .. payload, the input routes through the strip arm where .. persists unfiltered. The unsanitized value is then passed to backend operations without shlex.quote() escaping, enabling shell injection or path traversal attacks. This affects CWE-22 (Path Traversal), CWE-20 (Improper Input Validation), and CWE-117 (Improper Output Neutralization for Logs).

Business impact

Authenticated users can access or modify files on servers managed by Roxy-WI, potentially compromising HAProxy, Nginx, Apache, or Keepalived configurations. An attacker could exfiltrate sensitive data (private keys, credentials), alter load-balancer rules to redirect traffic, or disable services. For organizations relying on Roxy-WI for infrastructure automation, this increases the blast radius of credential compromise and reduces the trustworthiness of centralized configuration management.

Affected systems

Roxy-WI versions 8.2.6.4 and prior are vulnerable. The tool is used to manage HAProxy, Nginx, Apache, and Keepalived instances. Any organization deploying Roxy-WI in these versions, particularly those with untrusted or broadly-scoped user accounts, should be considered at risk.

Exploitability

Exploitation requires valid login credentials (PR:L in CVSS), so external unauthenticated attack is not possible. However, the attack is deterministic and does not require user interaction once an attacker is authenticated. The barrier to weaponization is low: appending a single character to a path traversal string is trivial. Given the centrality of the EscapedString validator across dozens of fields, multiple attack vectors likely exist.

Remediation

Await and apply a patched version from the Roxy-WI project as soon as it becomes available. In the interim, restrict Roxy-WI access to highly trusted administrators, implement network segmentation to limit authenticated user reach, and monitor file access on managed servers for suspicious ..-based paths. Consider disabling Roxy-WI if it is not critical to operations.

Patch guidance

No patches have been released as of the publication date (2026-06-10). Monitor the Roxy-WI GitHub repository and official announcements for patch availability. When a patch is released, verify its version number against the advisory and test in a non-production environment before deployment. Prioritize patching if Roxy-WI is exposed to untrusted networks or manages critical infrastructure.

Detection guidance

Hunt for authentication logs from Roxy-WI that precede file-access anomalies on managed servers (HAProxy, Nginx, Apache, Keepalived hosts). Look for repeated failed input validation warnings or exceptions in Roxy-WI logs containing .. or shell metacharacters. Monitor access to sensitive configuration files (e.g., /etc/nginx/nginx.conf, /etc/haproxy/haproxy.cfg) for unexpected read or write operations, particularly if correlated with Roxy-WI API calls. Endpoint detection and response (EDR) tools should flag unusual process spawning from Roxy-WI's process tree.

Why prioritize this

With a CVSS score of 8.1 (HIGH) and confirmed exploitability barriers only at the authentication gate, this vulnerability warrants immediate attention if Roxy-WI is deployed in your environment. The validator flaw is structural, affecting multiple fields, and the lack of a public patch compounds urgency. Organizations using Roxy-WI for production infrastructure should treat this as a critical access-control risk and escalate patch tracking.

Risk score, explained

The CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N score reflects: network-accessible attack surface (AV:N), low complexity requiring only credential possession and a simple payload mutation (AC:L), confidentiality and integrity impact at the scope of the managed servers (C:H, I:H), and no direct availability impact (A:N). The score is elevated because an authenticated user can deterministically extract or alter sensitive data without user interaction.

Frequently asked questions