CVE-2026-45569: 
Roxy-WI vulnerability analysis and mitigation

CVE-2026-45569 is a path traversal vulnerability in Roxy-WI, a web interface for managing HAProxy, Nginx, Apache, and Keepalived servers. The flaw exists in versions 8.2.6.4 and prior, where a security patch (commit d4d10006) intended to block directory traversal sequences is entirely ineffective due to a Python operator misuse. It was published on June 10, 2026, with no patched version available at time of disclosure. The vulnerability carries a CVSS v3.1 base score of 8.1 (High) (GitHub Advisory).

The root cause is a combination of CWE-22 (Path Traversal) and CWE-697 (Incorrect Comparison). In app/modules/config/config.py at line 462, commit d4d10006 changed the check to if '..' in (configs_dir, config_file_name, configver), which uses Python's tuple-membership operator — this evaluates to True only if one of the tuple elements is exactly equal to the string '..'. For any realistic traversal payload such as ../../etc/passwd, the check returns False and the payload passes through unchallenged. The correct fix would use substring containment: if any('..' in x for x in (configs_dir, config_file_name, configver)). The vulnerable configver parameter flows into a configs_dir + configver concatenation that is subsequently passed to open() server-side, enabling arbitrary file reads. The reachability chain is: POST /config/versions////save → save_version() (routes.py:201-227) → upload_and_restart() / get_config() → the buggy check at line 462 (GitHub Advisory, Buggy Commit).

Successful exploitation allows an authenticated attacker with role ≤ 3 (a low-privilege user) to read arbitrary files on the Roxy-WI host server. High-value targets include /var/lib/roxy-wi/keys/roxy-wi-key (the RS256 JWT signing private key, enabling offline minting of arbitrary authentication tokens for any user), /var/lib/roxy-wi/keys/*.pem (decrypted SSH private keys), and /etc/roxy-wi/roxy-wi.cfg (the Fernet secret_phrase used to decrypt stored credentials). Exfiltration of the JWT private key in particular could lead to full account takeover and lateral movement across all managed infrastructure (HAProxy, Nginx, Apache, Keepalived nodes) (GitHub Advisory).

1. Reconnaissance: Identify internet-facing Roxy-WI instances running version 8.2.6.4 or earlier using Shodan, Censys, or similar tools by searching for the Roxy-WI web interface fingerprint.
2. Obtain low-privilege credentials: Acquire valid credentials for any Roxy-WI account with role ≤ 3 (e.g., through phishing, credential stuffing, or default credentials).
3. Authenticate: Log in to the Roxy-WI web interface and obtain a valid session token or JWT.
4. Craft malicious request: Send a POST request to the config version save endpoint with a path traversal payload in the configver parameter:

   POST /config/versions////save
   configver=../../etc/passwd

5. Bypass the broken check: The tuple-membership check '..' in (configs_dir, config_file_name, configver) evaluates to False for the payload, allowing it to pass through to the open() call.
6. Read arbitrary files: The server opens and returns the contents of the traversed file. Target high-value files such as /var/lib/roxy-wi/keys/roxy-wi-key (JWT private key) or /etc/roxy-wi/roxy-wi.cfg (Fernet secret).
7. Escalate: Use the exfiltrated JWT private key to forge authentication tokens for any user, including administrators, enabling full control of the Roxy-WI instance and all managed servers (GitHub Advisory).

• Network: Unusual POST requests to /config/versions////save or similar config-related endpoints containing ../ or ..\ sequences in parameters; unexpected outbound connections from the Roxy-WI host following such requests.
• Logs: Web server access logs showing POST requests to /config/versions/ with encoded or raw path traversal sequences (e.g., %2e%2e, ..%2f, ../../) in the configver or config_file_name fields; repeated access attempts from a single authenticated user to config endpoints.
• File System: Unexpected access timestamps on sensitive files such as /var/lib/roxy-wi/keys/roxy-wi-key, /var/lib/roxy-wi/keys/*.pem, or /etc/roxy-wi/roxy-wi.cfg that do not correspond to normal application activity.
• Authentication: Appearance of JWT tokens signed with the legitimate private key but issued for unexpected users or at unusual times, potentially indicating offline token forgery following key exfiltration (GitHub Advisory).

As of the time of publication, no official patched version of Roxy-WI is available. The vendor has been notified and the advisory recommends the following code-level fix in app/modules/config/config.py at line 462: replace the buggy check with if any('..' in str(x) for x in (configs_dir, config_file_name, configver)): raise Exception('error: .. is not allowed'). A more robust mitigation is to normalize the resolved path using os.path.realpath() and assert it remains within the intended configs_dir before opening any file. Until a patch is released, administrators should restrict access to the Roxy-WI interface to trusted networks only, enforce strong authentication, and audit user accounts to minimize the number of accounts with role ≤ 3 (GitHub Advisory, Buggy Commit).

The vulnerability was discovered and reported by Vishal Shukla (@shukla304) and the Sechub.dev AI Agent, and published as a GitHub Security Advisory by the repository maintainer (Aidaho12) on May 15, 2026. The advisory explicitly notes the irony that the original commit d4d10006 was itself a security fix that introduced a new, more subtle bypass. No significant broader media coverage or notable social media discussion has been identified at this time (GitHub Advisory).