Roxy-wi vulnerabilities
We track 18 vulnerabilities in Roxy-wi products. 18 are rated high or critical, and none are known to be exploited. The most recent was published on June 10, 2026.
Latest Roxy-wi vulnerabilities
- 8.1 High severity
roxy-wi: Improper Limitation of a Pathname to a Restricted Directory
Roxy-WI is a web interface for managing Haproxy, Nginx, Apache and Keepalived servers. In versions 8.2.6.4 and prior, ommit d4d10006 ("Expand validation to block .. in config_file_name and configver for improved security") added a line in app/modules/config/co
- 8.3 High severity
roxy-wi: Improper Authentication
Roxy-WI is a web interface for managing Haproxy, Nginx, Apache and Keepalived servers. In versions 8.2.6.4 and prior, there is an authentication bypass vulnerability via 'api' substring in URL + unauthenticated /api/gpt. At time of publication, there are no pu
- 8.1 High severity
Roxy-WI is a web interface for managing Haproxy, Nginx, Apache and Keepalived servers.
Roxy-WI is a web interface for managing Haproxy, Nginx, Apache and Keepalived servers. In versions 8.2.6.4 and prior, EscapedString (app/modules/roxywi/class_models.py:16-30) is the centralised Pydantic validator used on dozens of fields including SSH credenti
- 8.8 High severity
roxy-wi: Improper Neutralization of Special Elements used in an OS Command
Roxy-WI is a web interface for managing Haproxy, Nginx, Apache and Keepalived servers. In versions 8.2.6.4 and prior, POST /config/versions/<service>/<server_ip>/<configver>/save interpolates the URL-path configver parameter directly into a config-version path
- 9.9 Critical severity
Roxy-WI is a web interface for managing Haproxy, Nginx, Apache and Keepalived servers.
Roxy-WI is a web interface for managing Haproxy, Nginx, Apache and Keepalived servers. In versions 8.2.6.4 and prior, the HAProxy section-save endpoints (POST /api/service/haproxy/<server_id>/section/<section_type> and the PUT / global / defaults variants) acc
- 9.9 Critical severity
Roxy-WI is a web interface for managing Haproxy, Nginx, Apache and Keepalived servers.
Roxy-WI is a web interface for managing Haproxy, Nginx, Apache and Keepalived servers. In versions 8.2.6.4 and prior, POST /waf/<service>/<server_ip>/rule/<rule_id>/save accepts a config_file_name form field that is passed straight through to config_mod.master
- 9.9 Critical severity
roxy-wi: Authorization Bypass Through User-Controlled Key
Roxy-WI is a web interface for managing Haproxy, Nginx, Apache and Keepalived servers. In versions 8.2.6.4 and prior, the install blueprint declares only bp.before_request → @jwt_required() (app/routes/install/routes.py:36-39). The individual endpoints install
- 9.1 Critical severity
roxy-wi: Authorization Bypass Through User-Controlled Key
Roxy-WI is a web interface for managing Haproxy, Nginx, Apache and Keepalived servers. In versions 8.2.6.4 and prior, PUT /smon/check (app/routes/smon/routes.py:117-138) gates only on roxywi_common.check_user_group_for_flask() — which validates that the caller
- 8.5 High severity
roxy-wi: Missing Authorization
Roxy-WI is a web interface for managing Haproxy, Nginx, Apache and Keepalived servers. In versions 8.2.6.4 and prior, agent_action (app/routes/smon/agent_routes.py:166-179) has decorators @bp.post('/agent/action/<action>') and @jwt_required() only — no role ch
- 8.8 High severity
roxy-wi: Improper Neutralization of Special Elements used in an OS Command
Roxy-WI is a web interface for managing Haproxy, Nginx, Apache and Keepalived servers. Prior to version 8.2.6.4, the /config/ < service > /find-in-config endpoint in Roxy-WI fails to sanitize the user-supplied words parameter before embedding it into a shell c
- 9.8 Critical severity
roxy-wi: Improper Neutralization of Special Elements used in an SQL Command
Roxy-WI is a web interface for managing Haproxy, Nginx, Apache and Keepalived servers. Versions prior to 8.2.6.4 have a SQL injection vulnerability in the haproxy_section_save function in app/routes/config/routes.py. The server_ip parameter, sourced from the U
- 7.5 High severity
roxy-wi: Improper Limitation of a Pathname to a Restricted Directory
Roxy-WI is a web interface for managing Haproxy, Nginx, Apache and Keepalived servers. Prior to version 8.2.6.4, the oldconfig parameter in the haproxy_section_save interface has an arbitrary file read vulnerability. Version 8.2.6.4 fixes the issue.
- 9.8 Critical severity
roxy-wi: Improper Limitation of a Pathname to a Restricted Directory
Roxy-WI is a web interface for managing Haproxy, Nginx, Apache and Keepalived servers. Prior to version 8.2.6.4, the haproxy_section_save interface presents a vulnerability that could lead to remote code execution due to path traversal and writing into schedul
- 9.1 Critical severity
roxy-wi: Improper Authentication
Roxy-WI is a web interface for managing Haproxy, Nginx, Apache and Keepalived servers. In versions up to and including 8.2.8.2, when LDAP authentication is enabled, Roxy-WI constructs an LDAP search filter by directly concatenating the user-supplied login user
- 8.8 High severity
roxy-wi: Improper Neutralization of Special Elements used in a Command
Roxy-WI is a web interface for managing Haproxy, Nginx, Apache and Keepalived servers. Prior to version 8.2.6.3, a command injection vulnerability exists in the `/config/compare/<service>/<server_ip>/show` endpoint, allowed authenticated users to execute arbit
- 7.5 High severity
roxy-wi: Improper Neutralization of Special Elements used in an OS Command
Roxy-WI is a web interface for managing Haproxy, Nginx, Apache and Keepalived servers. Prior to 8.2.8.2, command injection vulnerability exists in the log viewing functionality that allows authenticated users to execute arbitrary system commands. The vulnerabi
- 8.8 High severity
Roxy-WI: Improper Neutralization of Special Elements used in a Command
A vulnerability was found in Roxy-WI up to 8.1.3. It has been declared as critical. Affected by this vulnerability is the function action_service of the file app/modules/roxywi/roxy.py. The manipulation of the argument action/service leads to os command inject
- 8.8 High severity
roxy-wi: Improper Neutralization of Special Elements used in an OS Command
Roxy-WI is a web interface for managing Haproxy, Nginx, Apache and Keepalived servers. An OS Command Injection vulnerability allows any authenticated user on the application to execute arbitrary code on the web application server via port scanning functionalit