CVE-2026-45560

Name of the Vulnerable Software and Affected Versions Roxy-WI versions prior to 8.2.6.5

Description Roxy-WI is a web interface for managing Haproxy, Nginx, Apache, and Keepalived servers. The wrap line() and highlight word() functions build raw HTML using string concatenation without proper escaping. Additionally, the frontend uses .html(data) and .append(data) to inject the response body in log-viewer paths. An attacker who can write a line into a managed HAProxy or Nginx access log, such as by sending an HTTP request to the public load balancer, can execute a malicious payload when an administrator opens the log viewer.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.