CVE-2026-45569

Name of the Vulnerable Software and Affected Versions Roxy-WI versions prior to 8.2.6.5

Description A path-traversal issue exists in the web interface used for managing Haproxy, Nginx, Apache, and Keepalived servers. A security check implemented in the config.py file within the app/modules/config/ module incorrectly uses tuple-membership instead of substring containment when validating the config file name and configver variables. Consequently, the validation fails to block payloads containing directory traversal sequences, such as ../../etc/passwd, allowing them to pass through the filter.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.