CVE-2026-45565: falha de alta gravidade em roxy-wi
Roxy-WI: EscapedString validator skips its '..' block when stripping (root cause for several path-traversal/RCE vectors)
Publicada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
21Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 8.1epss 0.3%
Roxy-WI is a web interface for managing Haproxy, Nginx, Apache and Keepalived servers. In versions 8.2.6.4 and prior, EscapedString (app/modules/roxywi/class_models.py:16-30) is the centralised Pydantic validator used on dozens of fields including SSH credential name, username, description, etc. Its if/elif/elif/else flow returns the metacharacter-stripped value without also enforcing the .. block. An attacker who appends a single ;, &, |, $, or backtick to a .. payload routes the value through the strip arm, where .. survives unblocked and the result is not shlex.quote()'d either. At time of publication, there are no publicly available patches.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
Produtos afetados
roxy-wi · roxy-wiCVEs relacionadas — roxy-wi
No mesmo produto, das mais perigosas para as menos.
CVE-2024-43804HIGHOS Command Injection via Port Scan Functionality in Roxy-WIEPSS 2.5%CVE-2026-22265HIGHRoxy-WI has a Command Injection via grep parameter in logs.py allows authenticated RCEEPSS 2.3%CVE-2026-27811HIGHRoxy-WI has a Command Injection via diff parameter in config comparison allows authenticated RCEEPSS 2.1%CVE-2026-33076HIGHRoxy-WI vulnerable to path traversal and arbitrary file writingEPSS 0.8%CVE-2026-33208HIGHRoxy-WI Vulnerable to Authenticated Remote Code Execution via OS Command Injection in find-in-config EndpointEPSS 0.7%CVE-2026-45558CRITICALRoxy-WI: Authenticated RCE on every managed HAProxy load balancer via `option` field config injection in section saveEPSS 0.4%