Remote Code Execution Vulnerability in Roxy-WI Web Interface for Haproxy, Nginx, Apache, and Keepalived
CVE-2026-33076

8.9HIGH

Key Information:

Vendor

Roxy-wi

Status
Roxy-wi
Vendor
CVE Published:
24 April 2026

What is CVE-2026-33076?

A vulnerability in Roxy-WI, a web interface for server management including Haproxy, Nginx, Apache, and Keepalived, allows for remote code execution through improper handling of the haproxy_section_save interface. Attackers can exploit this issue by manipulating file paths, thereby gaining unauthorized access to write into scheduled tasks. This vulnerability affects versions prior to 8.2.6.4, which has since addressed the flaw.

Affected Version(s)

roxy-wi < 8.2.6.4

References

https://github.com/roxy-wi/roxy-wi/security/advisories/GH...
x_refsource_CONFIRM
https://github.com/roxy-wi/roxy-wi/commit/aecc7971959092f...
x_refsource_MISC

CVSS V4

Score:
8.9
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.