CVE-2026-45565: Roxy-WI: EscapedString validator skips its '..' block when stripping (root cause for several path-traversal/RCE vectors)
Roxy-WI is a web interface for managing Haproxy, Nginx, Apache and Keepalived servers. In versions 8.2.6.4 and prior, EscapedString (app/modules/roxywi/classmodels.py:16-30) is the centralised Pydantic validator used on dozens of fields including SSH credential name, username, description, etc. Its if/elif/elif/else flow returns the metacharacter-stripped value without also enforcing the .. block. An attacker who appends a single ;, &, |, $, or backtick to a .. payload routes the value through the strip arm, where .. survives unblocked and the result is not shlex.quote()'d either. At time of publication, there are no publicly available patches.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Remove
Remove
Roxy-WIfrom your environment.Uninstall Roxy-WI from systems where it is not required, or remove the exposed management component until a patched release is available.
- Compensating control
Restrict access to the Roxy-WI web interface and management endpoints to trusted IP addresses only (for example via host-based firewall, network ACLs, or placing the interface behind a VPN). Limit administrative access and remove any public exposure of the management UI.
- Compensating control
Deploy WAF or reverse-proxy rules to detect and block requests containing path-traversal sequences ("..") combined with trailing shell metacharacters such as ; & | $ `, or other suspicious combinations that may attempt command injection or path traversal.
- Operational
Audit stored SSH credentials, usernames and related configuration in Roxy-WI and rotate any credentials, keys, or secrets that may have been stored or exposed. Review access and application logs for suspicious activity related to path traversal or command injection attempts.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-45565?
CVE-2026-45565 has a severity score of 8.1, categorizing it as high risk.
How do I fix CVE-2026-45565?
To fix CVE-2026-45565, upgrade Roxy-WI to version 8.2.6.5 or later.
What type of vulnerability is CVE-2026-45565?
CVE-2026-45565 is an input validation vulnerability that can lead to path traversal and remote code execution.
Which software is affected by CVE-2026-45565?
CVE-2026-45565 affects Roxy-WI versions 8.2.6.4 and earlier.
What is the root cause of CVE-2026-45565?
The root cause of CVE-2026-45565 is the EscapedString validator in Roxy-WI, which fails to properly handle certain inputs, leading to security risks.