CVE-2026-33208

The CVE describes a vulnerability in Roxy-WI, a web interface for managing HAProxy, Nginx, Apache, and Keepalived. Before version 8.2.6.4, the /config//find-in-config endpoint fails to sanitize the words parameter before embedding it into a shell command string executed on a remote managed server...

CVE-2026-33431 Roxy-WI Vulnerable to Authenticated Arbitrary File Read via Path Traversal in Config Version Viewer

Roxy-WI is a web interface for managing Haproxy, Nginx, Apache and Keepalived servers. Prior to version 8.2.6.4, the POST /config//show API endpoint accepts a configver parameter that is directly appended to a base directory path to construct a local file path, which is subsequently opened and it...