CVE-2026-45560: Roxy-WI: Stored XSS in log viewer (wrap_line/highlight_word produce unescaped HTML)
Roxy-WI is a web interface for managing Haproxy, Nginx, Apache and Keepalived servers. In versions 8.2.6.4 and prior, wrapline (app/modules/common/common.py:181-186) and highlightword (app/modules/common/common.py:188-192) build raw HTML by string concatenation with no escaping. The frontend (app/static/js/script.js, log-viewer paths) uses .html(data) / .append(data) to inject the response body. Anyone able to write a line into a managed HAProxy/Nginx access log (i.e. anyone who can send an HTTP request to the public LB) can land an <svg/onload=…> payload that executes when a Roxy-WI admin opens the log viewer. At time of publication, there are no publicly available patches.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Replace uses of .html(data) and .append(data) that insert log lines with a safe method: either HTML-escape the log content before insertion or use text-insertion APIs (e.g., .text() or equivalent) so raw HTML in logs is not interpreted by the browser.
Roxy-WI frontend (app/static/js/script.js, log viewer paths) DOM injection method = escape HTML / use text insertion instead of .html/.append - Configuration
Modify wrap_line and highlight_word to HTML-escape any log content before concatenating/building HTML output (do not build raw HTML from unescaped log contents).
Roxy-WI backend (app/modules/common/common.py) wrap_line / highlight_word output encoding = HTML-escape log text before composing output - Compensating control
Restrict access to the Roxy-WI admin interface and log viewer to trusted administrator networks only (via firewall rules, network ACLs, or requiring access over a VPN) so attackers cannot write logs that will be viewed by admins.
- Compensating control
Deploy WAF or ingress filtering rules to block or sanitize incoming HTTP requests that attempt to inject markup into logs (for example, block requests containing '<svg', '<script', or raw '<' characters in fields that are logged) at the public load balancer/edge.
- Operational
Until code fixes are applied, avoid opening the Roxy-WI log viewer to review logs; instead retrieve logs via alternative means and review them with a tool that safely escapes or sanitizes HTML.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-45560?
CVE-2026-45560 has a medium severity score of 6.1.
How do I fix CVE-2026-45560?
To fix CVE-2026-45560, update Roxy-WI to version 8.2.6.5 or later.
What vulnerabilities are associated with CVE-2026-45560?
CVE-2026-45560 is associated with a stored XSS vulnerability due to unescaped HTML in the log viewer.
What impact does CVE-2026-45560 have on users?
CVE-2026-45560 can allow attackers to execute arbitrary JavaScript in the context of affected users' browsers.
What components of Roxy-WI are affected by CVE-2026-45560?
The wrap_line and highlight_word functions in the log viewer are affected by CVE-2026-45560.