CVE-2026-33078: Roxy-WI has SQL Injection in haproxy_section_save Endpoint via Unsanitized server_ip Parameter
Roxy-WI is a web interface for managing Haproxy, Nginx, Apache and Keepalived servers. Versions prior to 8.2.6.4 have a SQL injection vulnerability in the haproxysectionsave function in app/routes/config/routes.py. The serverip parameter, sourced from the URL path, is passed unsanitized through multiple function calls and ultimately interpolated into a SQL query string using Python string formatting, allowing attackers to execute arbitrary SQL commands. Version 8.2.6.4 fixes the issue.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2026-33078?
CVE-2026-33078 is classified as a critical severity vulnerability due to its potential for SQL injection.
How do I fix CVE-2026-33078?
To fix CVE-2026-33078, upgrade Roxy-WI to version 8.2.6.4 or later where the vulnerability has been addressed.
What does CVE-2026-33078 affect?
CVE-2026-33078 affects Roxy-WI versions prior to 8.2.6.4, particularly in the haproxy_section_save endpoint.
What type of vulnerability is CVE-2026-33078?
CVE-2026-33078 is an SQL injection vulnerability caused by unsanitized input from the server_ip parameter.
What could happen if CVE-2026-33078 is exploited?
If exploited, CVE-2026-33078 could allow an attacker to execute arbitrary SQL queries, potentially compromising the database.