CVE-2026-22265: Roxy-WI has a Command Injection via grep parameter in logs.py allows authenticated RCE
Roxy-WI is a web interface for managing Haproxy, Nginx, Apache and Keepalived servers. Prior to 8.2.8.2, command injection vulnerability exists in the log viewing functionality that allows authenticated users to execute arbitrary system commands. The vulnerability is in app/modules/roxywi/logs.py line 87, where the grep parameter is used twice - once sanitized and once raw. This vulnerability is fixed in 8.2.8.2.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2026-22265?
CVE-2026-22265 is classified as a high severity command injection vulnerability.
How do I fix CVE-2026-22265?
To mitigate CVE-2026-22265, upgrade Roxy-WI to version 8.2.8.2 or later.
Who is affected by CVE-2026-22265?
CVE-2026-22265 affects users of Roxy-WI versions prior to 8.2.8.2.
What type of vulnerability is CVE-2026-22265?
CVE-2026-22265 is a command injection vulnerability that allows remote code execution.
Can CVE-2026-22265 be exploited by unauthenticated users?
No, CVE-2026-22265 can only be exploited by authenticated users.