CVE-2026-27811: Roxy-WI has a Command Injection via diff parameter in config comparison allows authenticated RCE
Roxy-WI is a web interface for managing Haproxy, Nginx, Apache and Keepalived servers. Prior to version 8.2.6.3, a command injection vulnerability exists in the /config/compare/<service>/<serverip>/show endpoint, allowed authenticated users to execute arbitrary system commands on the app host. The vulnerability exists in app/modules/config/config.py on line 362, where user input is directly formatted in the template string that is eventually executed. Version 8.2.6.3 fixes the issue.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2026-27811?
CVE-2026-27811 is considered a high-severity command injection vulnerability that allows authenticated remote code execution.
How do I fix CVE-2026-27811?
To fix CVE-2026-27811, upgrade Roxy-WI to version 8.2.6.3 or later.
What component is affected by CVE-2026-27811?
CVE-2026-27811 affects the configuration comparison feature in Roxy-WI software.
Who can exploit CVE-2026-27811?
CVE-2026-27811 can be exploited by authenticated users who have access to the Roxy-WI interface.
What are the potential impacts of CVE-2026-27811?
Exploitation of CVE-2026-27811 can lead to unauthorized command execution on the server where Roxy-WI is hosted.