CVE-2026-45565

Name of the Vulnerable Software and Affected Versions Roxy-WI versions prior to 8.2.6.5

Description Roxy-WI is a web interface for managing Haproxy, Nginx, Apache, and Keepalived servers. The EscapedString function (located in app/modules/roxywi/class models.py:16-30) acts as a centralized Pydantic validator for numerous fields, such as SSH credential name, username, and description. A flaw in the logic flow allows an attacker to bypass the block on directory traversal sequences (..) by appending specific metacharacters like ;, &, |, $, or backticks. This causes the input to be processed through a stripping mechanism that fails to block the traversal sequence or apply shlex.quote(), potentially leading to command injection or unauthorized file access.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.