CVE-2026-45564

Popis

Roxy-WI is a web interface for managing Haproxy, Nginx, Apache and Keepalived servers. In versions 8.2.6.4 and prior, POST /config/versions/<service>/<server_ip>/<configver>/save interpolates the URL-path configver parameter directly into a config-version path that ends up at os.system(f-dos2unix -q {cfg}-). configver is not run through EscapedString (Pydantic doesn-t validate path segments declared as str) and the surrounding .. block is the broken tuple-membership patch from GHSA-vapt-004. An authenticated user with role <= 3 (-user-) therefore reaches a bin/sh -c command-injection sink. At time of publication, there are no publicly available patches.