CVE-2026-45564

Name of the Vulnerable Software and Affected Versions Roxy-WI versions prior to 8.2.6.5

Description An authenticated user with a role of 3 or lower can execute arbitrary commands via a command-injection sink in bin/sh -c. The issue occurs because the configver parameter in the '/config/versions////save' endpoint is interpolated directly into a path used by the os.system() function to run dos2unix, without being processed by EscapedString.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.