CVE-2026-33431: 
Roxy-WI vulnerability analysis and mitigation

CVE-2026-33431 is an authenticated arbitrary file read vulnerability via path traversal in Roxy-WI, a web interface for managing HAProxy, Nginx, Apache, and Keepalived servers. It affects all versions prior to 8.2.6.4 and was published on April 20, 2026, with a patch released shortly after. The flaw resides in the POST /config/<service>/show API endpoint, where the configver parameter is appended to a base directory path without sanitization, allowing authenticated attackers to read arbitrary files. It carries a CVSS v3.1 base score of 6.5 (Medium) and a CVSS v4.0 score of 5.7 (Medium) (GitHub Advisory, Feedly).

The root cause is a logic error in the path traversal guard within app/modules/config/config.py (lines 436–497), classified as CWE-24 (Path Traversal: '../filedir'). The guard checks if '..' in configs_dir — but configs_dir is always a server-side fixed value (e.g., /var/lib/roxy-wi/configs/haproxy/) and never contains .., making the check permanently ineffective. The user-supplied configver value from the HTTP request body is concatenated directly to configs_dir and passed to open() without any sanitization, allowing sequences like ../../../../etc/passwd to escape the intended directory. The patch (commit d4d1000) corrects this by expanding the check to if '..' in (configs_dir, config_file_name, configver) (GitHub Advisory, Patch Commit).

Successful exploitation allows any authenticated user — regardless of assigned role — to read arbitrary files accessible to the web application process, including sensitive system files such as /etc/passwd, /etc/shadow, and SSH private keys. A particularly critical chained attack involves reading the Roxy-WI application configuration file (/etc/roxy-wi/roxy-wi.cfg) to obtain the secret_phrase Fernet symmetric key, which is used to encrypt all SSH credentials stored in the database. With this key, an attacker can decrypt every SSH password and passphrase in the managed inventory, enabling lateral movement to all servers managed by the Roxy-WI instance without triggering authentication events on those servers (GitHub Advisory).

A proof-of-concept exploit is publicly available in the GitHub Security Advisory, providing concrete step-by-step HTTP POST requests with specific payloads (e.g., configver: '../../../../etc/passwd'). Exploitation requires only a valid authenticated session with low privileges and no user interaction. As of the time of reporting, there is no evidence of active in-the-wild exploitation, and the vulnerability is not listed in the CISA KEV catalog. The EPSS score is approximately 0.043% (GitHub Advisory, Feedly).

1. Authenticate: Obtain a valid session cookie or JWT access token for any Roxy-WI account, regardless of privilege level.
2. Identify target endpoint: Target the POST /config/<service>/show endpoint, where <service> can be haproxy, nginx, apache, or keepalived.
3. Craft path traversal payload: Construct a JSON request body with a configver value containing ../ sequences to escape the base config directory, e.g., ../../../../etc/passwd.
4. Send the request:

POST /config/haproxy/show HTTP/1.1
Host: <target>
Cookie: access_token_cookie=<token>
Content-Type: application/json

{"serv": "192.168.1.10", "configver": "../../../../etc/passwd", "config_file_name": null, "edit_section": null}

5. Read application config for encryption key: Repeat with configver: '../../../../etc/roxy-wi/roxy-wi.cfg' to retrieve the secret_phrase Fernet key used to encrypt SSH credentials in the database.
6. Decrypt SSH credentials: Use the recovered secret_phrase key with the Fernet library to decrypt all SSH passwords stored in the Roxy-WI database.
7. Lateral movement: Use the decrypted SSH credentials to authenticate to all servers in the managed inventory (GitHub Advisory).

• Network: Unusual POST requests to /config/haproxy/show, /config/nginx/show, /config/apache/show, or /config/keepalived/show endpoints with JSON bodies containing ../ sequences in the configver field.
• Logs: Web application access logs showing repeated POST requests to /config/<service>/show with encoded or plaintext path traversal strings (e.g., ../../../../etc/passwd, ../../../../etc/shadow, ../../../../root/.ssh/id_rsa, ../../../../etc/roxy-wi/roxy-wi.cfg) in request bodies.
• File System: No direct file system artifacts from read-only exploitation; however, subsequent use of decrypted SSH credentials may appear as new or unexpected SSH login events on managed servers.
• Process: Unexpected file read operations by the Roxy-WI web process targeting files outside /var/lib/roxy-wi/configs/ (observable via auditd or similar file access monitoring) (GitHub Advisory).

Upgrade Roxy-WI to version 8.2.6.4 or later, which contains the patch expanding the path traversal guard to validate the configver and config_file_name parameters in addition to configs_dir. No configuration-based workaround is available that fully mitigates the issue without patching. As an interim measure, restrict access to the Roxy-WI web interface to trusted networks or authenticated VPN users to reduce the attack surface (GitHub Advisory, Patch Commit).

The vulnerability was reported by researcher Firebasky and published by the Roxy-WI maintainer (Aidaho12) via a GitHub Security Advisory on April 18, 2026. No significant broader media coverage or notable public researcher commentary beyond the advisory itself has been identified at this time (GitHub Advisory).