CVE-2026-45565: 
Roxy-WI vulnerability analysis and mitigation

CVE-2026-45565 is a path traversal and improper input validation vulnerability in Roxy-WI, a web interface for managing HAProxy, Nginx, Apache, and Keepalived servers. The flaw resides in the EscapedString Pydantic validator (app/modules/roxywi/class_models.py:16-30), which is applied to approximately 52 fields including SSH credential names, usernames, and descriptions. Due to a logic flaw in its if/elif/elif/else flow, appending a shell metacharacter (;, &, |, $, or backtick) to a .. path traversal payload causes the validator to strip the metacharacter but leave the .. sequence intact and unquoted. All versions up to and including 8.2.6.4 are affected, with no patch available at time of publication. The vulnerability carries a CVSS v3.1 base score of 8.1 (High) (GitHub Advisory).

The root cause is a mutually exclusive branch structure in the EscapedString.validate() method (CWE-20, CWE-22). When input contains a metacharacter matched by the regex [&;|$\], the method enters the strip branch, removes the metacharacter, and returns the result — without ever checking for ..sequences or applyingshlex.quote(). This means a payload like ../../etc/passwd;passes through as../../etc/passwd, fully unquoted and unblocked. The flaw is the root cause for several downstream vulnerabilities: arbitrary file write of decrypted SSH private keys via cred.name → _return_correct_ssh_file(writing to attacker-controlled paths), path traversal inHaproxyListView, and a remote code execution vector in configverviaos.system(f"dos2unix -q {cfg}")`. A proof-of-concept demonstrating the bypass is included in the GitHub Security Advisory (GitHub Advisory).

Successful exploitation allows an authenticated attacker with low privileges to perform path traversal across the server filesystem, write arbitrary file content (e.g., attacker-controlled SSH private keys to arbitrary paths), and achieve remote code execution through unsanitized input passed to shell commands such as os.system(). The confidentiality and integrity impacts are rated High, as attackers can read sensitive files (e.g., /etc/passwd, private keys) and write or overwrite files in arbitrary locations. The vulnerability affects approximately 52 Pydantic fields across the application, significantly broadening the attack surface (GitHub Advisory).

1. Reconnaissance: Identify a Roxy-WI instance running version 8.2.6.4 or earlier. Obtain or register a low-privilege account on the web interface.
2. Craft the bypass payload: Construct a path traversal string such as ../../etc/passwd; or ../../tmp/x;. The trailing ; (or any of &, |, $, backtick) triggers the metacharacter strip branch in EscapedString.validate(), which removes the metacharacter but leaves ../.. intact and unquoted.
3. Submit to a vulnerable field: Supply the crafted payload to any of the ~52 fields validated by EscapedString — for example, the SSH credential name field in the web UI.
4. Trigger file write (path traversal): With cred.name = '../../tmp/x;', the application calls _return_correct_ssh_file and opens /keys/../../tmp/x_.pem for writing, effectively writing attacker-controlled content (e.g., a fake SSH private key) to /tmp/x_.pem.
5. Achieve RCE via configver: Supply a payload that reaches the configver sink, where the unsanitized, unquoted value is passed to os.system(f"dos2unix -q {cfg}"), enabling arbitrary command execution on the server (GitHub Advisory).

• Logs: Application logs showing field values containing .. sequences in SSH credential names, usernames, or descriptions; log entries referencing unexpected file paths in /tmp, /etc, or other sensitive directories.
• File System: Unexpected .pem files in directories outside /keys/ (e.g., /tmp/*.pem); modified or newly created files in sensitive directories such as /etc/ or /tmp/ owned by the Roxy-WI service account; unexpected HAProxy configuration files in non-standard paths.
• Process: Unusual child processes spawned by the Roxy-WI Python process (e.g., dos2unix, sh, bash) with unexpected arguments referencing traversal paths; os.system() calls with attacker-controlled arguments visible in process audit logs.
• Network: Authenticated API or web requests to Roxy-WI endpoints (e.g., SSH credential management, HAProxy list management, config version save) containing URL-encoded .. sequences or shell metacharacters in field values (GitHub Advisory).

No official patch is available as of the time of publication for versions up to and including 8.2.6.4. The GitHub Security Advisory recommends fixing the EscapedString.validate() method by moving the .. check above the metacharacter strip branch and applying shlex.quote() to all return values, ensuring no code path bypasses both checks. Additionally, the advisory recommends rejecting /, \, and NUL bytes for fields used as filename components. As a workaround, administrators should restrict access to the Roxy-WI web interface to trusted networks only, enforce strong authentication, and monitor for anomalous file creation or process execution. Monitor the Roxy-WI GitHub repository for patch releases (GitHub Advisory).

The vulnerability was discovered and reported by Vishal Shukla (@shukla304) and the Sechub.dev AI Agent, and published by repository maintainer Aidaho12 on May 15, 2026. No significant broader media coverage or notable public researcher commentary beyond the GitHub Security Advisory has been identified at this time (GitHub Advisory).