CVE-2026-22265

Name of the Vulnerable Software and Affected Versions Roxy-WI versions prior to 8.2.8.2

Description Roxy-WI, a web interface for managing Haproxy, Nginx, Apache and Keepalived servers, contains a command injection issue in the log viewing functionality. Authenticated users can execute arbitrary system commands due to unsanitized input used with the grep parameter in app/modules/roxywi/logs.py line 87. The parameter is used both sanitized and raw, creating the opportunity for exploitation.

Recommendations Upgrade to Roxy-WI version 8.2.8.2 or later.