CVE-2026-45564: Roxy-WI: Authenticated RCE via 'configver' URL parameter (os.system sink in /config/versions/.../save)
Roxy-WI is a web interface for managing Haproxy, Nginx, Apache and Keepalived servers. In versions 8.2.6.4 and prior, POST /config/versions/<service>/<serverip>/<configver>/save interpolates the URL-path configver parameter directly into a config-version path that ends up at os.system(f"dos2unix -q {cfg}"). configver is not run through EscapedString (Pydantic doesn't validate path segments declared as str) and the surrounding .. block is the broken tuple-membership patch from GHSA-vapt-004. An authenticated user with role <= 3 ("user") therefore reaches a bin/sh -c command-injection sink. At time of publication, there are no publicly available patches.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Remove
Remove
Roxy-WIfrom your environment.Uninstall Roxy-WI from systems where it is not required to eliminate the vulnerable component until a patch is available.
- Configuration
Configure Roxy-WI to require an administrative role (role >3) for POST /config/versions/<service>/<server_ip>/<configver>/save, or disable this endpoint entirely until an upstream fix is available.
Roxy-WI access_control_for_/config/versions/.../save = require role >3 or disabled - Compensating control
Restrict network access to the Roxy-WI management interface to trusted IP ranges (via firewall, VPN, or network ACLs) and apply WAF or filtering rules to block or inspect POST requests to /config/versions/*/save.
- Operational
Audit all accounts with role <=3 (users) and temporarily disable or restrict them to trusted operators; review logs for any access or attempts to POST to /config/versions/.../save and investigate suspicious activity.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-45564?
CVE-2026-45564 has a high severity score of 8.8.
How can I mitigate CVE-2026-45564?
To mitigate CVE-2026-45564, update Roxy-WI to version 8.2.6.5 or later.
What systems are affected by CVE-2026-45564?
CVE-2026-45564 affects Roxy-WI versions 8.2.6.4 and earlier.
What type of vulnerability is CVE-2026-45564?
CVE-2026-45564 is classified as an OS Command Injection vulnerability.
What is the impact of exploiting CVE-2026-45564?
Exploiting CVE-2026-45564 allows authenticated remote code execution through the configver URL parameter.