CVE-2026-45569: Roxy-WI: Path-traversal patch in commit d4d10006 is a no-op (tuple-membership bug)
Roxy-WI is a web interface for managing Haproxy, Nginx, Apache and Keepalived servers. In versions 8.2.6.4 and prior, ommit d4d10006 ("Expand validation to block .. in configfilename and configver for improved security") added a line in app/modules/config/config.py:462. This is tuple-membership, not substring containment — '..' in (a, b, c) evaluates to True only if any of a, b, c is equal to the literal string '..'. For any realistic path-traversal payload (../../etc/passwd, ..\\..\\etc\\passwd, etc.) the check returns False and the patch silently lets the payload through. At time of publication, there are no publicly available patches.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Remove
Remove
Roxy-WIfrom your environment.If you are running Roxy-WI version 8.2.6.4 or an earlier release that contains commit d4d10006, uninstall Roxy-WI (or take the instance offline) until an authoritative, working patch is made available.
- Compensating control
Restrict network access to the Roxy-WI web interface to trusted management IPs only (firewall/ACLs, VPN, or on-prem management network) to prevent unauthenticated or remote attackers from reaching the vulnerable functionality.
- Compensating control
Deploy WAF/IDS rules to block or alert on directory-traversal payloads and suspicious parameter values. Specifically block or inspect requests containing sequences like “../../etc/passwd” and “..\\..\\etc\\passwd”, and monitor requests targeting parameters named config_file_name and configver.
- Operational
Monitor Roxy-WI access and application logs for exploitation attempts (requests containing “..”, “../”, “..\\”, or the example payloads ../../etc/passwd and ..\\..\\etc\\passwd). If any indicators of compromise are found, perform incident response actions such as isolating affected hosts and rotating any credentials or secrets that may have been exposed.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-45569?
The severity of CVE-2026-45569 is rated high, with a score of 8.1.
What type of vulnerability is associated with CVE-2026-45569?
CVE-2026-45569 is a path traversal vulnerability.
How do I fix CVE-2026-45569?
To fix CVE-2026-45569, you should upgrade to the latest version of Roxy-WI that addresses this vulnerability.
What software is affected by CVE-2026-45569?
CVE-2026-45569 affects Roxy-WI versions 8.2.6.4 and prior.
What does CVE-2026-45569 impact in Roxy-WI?
CVE-2026-45569 impacts the security of configuration file handling in Roxy-WI.