CVE-2026-33431 Details
Description
Roxy-WI is a web interface for managing Haproxy, Nginx, Apache and Keepalived servers. Prior to version 8.2.6.4, the POST /config/<service>/show API endpoint accepts a configver parameter that is directly appended to a base directory path to construct a local file path, which is subsequently opened and its contents returned to the caller. The existing path traversal guard only inspects the base directory variable (which is never user-controlled) and entirely ignores the user-supplied configver value. An authenticated attacker can supply a configver value containing `../` sequences to escape the intended directory and read arbitrary files accessible to the web application process. Version 8.2.6.4 contains a patch for the issue.
A path traversal vulnerability has been identified in Roxy-WI versions prior to 8.2.6.4. The issue arises in the POST /config/<service>/show API endpoint, where the configver parameter is appended to a base directory path without proper validation. This oversight allows authenticated attackers to inject ../ sequences, escape the intended directory, and access arbitrary files on the server that are readable by the web application process. The vulnerability exists due to a logic error in the path traversal guard, which only checks a server-side variable that never contains user-controlled data.
Users should update to Roxy-WI version 8.2.6.4 or later, where this vulnerability has been patched.
Metrics
CVSS 4.0 Severity and Vector Strings:
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Apr 21, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/roxy-wi/roxy-wi/security/advisories/GHSA-w3c9-36jf-qrw4 | CISA-ADP | ExploitVendor Advisory |
| https://github.com/roxy-wi/roxy-wi/commit/d4d100067dd0ee04317f05d3b51be8fcfdc3f802 | [email protected] | Patch |
| https://github.com/roxy-wi/roxy-wi/security/advisories/GHSA-w3c9-36jf-qrw4 | [email protected] | ExploitVendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-24 | Path Traversal: '../filedir' | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| roxy-wi roxy-wi | < 8.2.6.4 |
CPE
Remediation
| |
Change History
5 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Apr 24, 2026 | Initial Analysis | [email protected] |
| Apr 21, 2026 | CVE Modified | CISA-ADP |
| Apr 20, 2026 | New CVE Received | [email protected] |